<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link href="common/css/sf.css" rel="stylesheet" type="text/css" />
<title>Hoare: Hoare Logic, Part I</title>
<link href="common/jquery-ui/jquery-ui.css" rel="stylesheet">
<script src="common/jquery-ui/external/jquery/jquery.js"></script>
<script src="common/jquery-ui/jquery-ui.js"></script>
<script src="common/toggleproofs.js"></script>
<link href="common/css/plf.css" rel="stylesheet" type="text/css"/>
</head>

<body>

<div id="page">

<div id="header">
<div id='logoinheader'><a href='https://softwarefoundations.cis.upenn.edu'>
<img src='common/media/image/sf_logo_sm.png' alt='Software Foundations Logo'></a></div>
<div class='booktitleinheader'><a href='index.html'>Volume 2: Programming Language Foundations</a></div>
<ul id='menu'>
   <li class='section_name'><a href='toc.html'>Table of Contents</a></li>
   <li class='section_name'><a href='coqindex.html'>Index</a></li>
   <li class='section_name'><a href='deps.html'>Roadmap</a></li>
</ul>
</div>

<div id="main">

<h1 class="libtitle">Hoare<span class="subtitle">Hoare Logic, Part I</span></h1>


<div class="code">

<span class="id" title="keyword">Set</span> <span class="id" title="var">Warnings</span> "-notation-overridden,-parsing,-deprecated-hint-without-locality".<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">PLF</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <span class="id" title="library">Maps</span>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Bool.Bool.html#"><span class="id" title="library">Bool.Bool</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.Arith.html#"><span class="id" title="library">Arith.Arith</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.EqNat.html#"><span class="id" title="library">Arith.EqNat</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#"><span class="id" title="library">Arith.PeanoNat</span></a>. <span class="id" title="keyword">Import</span> <span class="id" title="var">Nat</span>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">Coq</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Import</span> <a class="idref" href="http://coq.inria.fr/library//Coq.micromega.Lia.html#"><span class="id" title="library">Lia</span></a>.<br/>
<span class="id" title="keyword">From</span> <span class="id" title="var">PLF</span> <span class="id" title="keyword">Require</span> <span class="id" title="keyword">Export</span> <span class="id" title="library">Imp</span>.<br/>
</div>

<div class="doc">
In the final chaper of <i>Logical Foundations</i> (<i>Software
    Foundations</i>, volume 1), we began applying the mathematical tools
    developed in the first part of the course to studying the theory
    of a small programming language, Imp.

<div class="paragraph"> </div>

<ul class="doclist">
<li> We defined a type of <i>abstract syntax trees</i> for Imp, together
      with an <i>evaluation relation</i> (a partial function on states)
      that specifies the <i>operational semantics</i> of programs.

<div class="paragraph"> </div>

      The language we defined, though small, captures some of the key
      features of full-blown languages like C, C++, and Java,
      including the fundamental notion of mutable state and some
      common control structures.

<div class="paragraph"> </div>


</li>
<li> We proved a number of <i>metatheoretic properties</i> -- "meta" in
      the sense that they are properties of the language as a whole,
      rather than of particular programs in the language.  These
      included:

<div class="paragraph"> </div>

<ul class="doclist">
<li> determinism of evaluation

<div class="paragraph"> </div>


</li>
<li> equivalence of some different ways of writing down the
          definitions (e.g., functional and relational definitions of
          arithmetic expression evaluation)

<div class="paragraph"> </div>


</li>
<li> guaranteed termination of certain classes of programs

<div class="paragraph"> </div>


</li>
<li> correctness (in the sense of preserving meaning) of a number
          of useful program transformations

<div class="paragraph"> </div>


</li>
<li> behavioral equivalence of programs (in the <a href="Equiv.html"><span class="inlineref">Equiv</span></a>
          chapter). 
</li>
</ul>

</li>
</ul>

<div class="paragraph"> </div>

 If we stopped here, we would already have something useful: a set
    of tools for defining and discussing programming languages and
    language features that are mathematically precise, flexible, and
    easy to work with, applied to a set of key properties.  All of
    these properties are things that language designers, compiler
    writers, and users might care about knowing.  Indeed, many of them
    are so fundamental to our understanding of the programming
    languages we deal with that we might not consciously recognize
    them as "theorems."  But properties that seem intuitively obvious
    can sometimes be quite subtle (sometimes also subtly wrong!).

<div class="paragraph"> </div>

    We'll return to the theme of metatheoretic properties of whole
    languages later in this volume when we discuss <i>types</i> and <i>type
    soundness</i>.  In this chapter, though, we turn to a different set
    of issues.

<div class="paragraph"> </div>

 Our goal is to carry out some simple examples of <i>program
    verification</i> -- i.e., to use the precise definition of Imp to
    prove formally that particular programs satisfy particular
    specifications of their behavior.  We'll develop a reasoning
    system called <i>Floyd-Hoare Logic</i> -- often shortened to just
    <i>Hoare Logic</i> -- in which each of the syntactic constructs of Imp
    is equipped with a generic "proof rule" that can be used to reason
    compositionally about the correctness of programs involving this
    construct.

<div class="paragraph"> </div>

    Hoare Logic originated in the 1960s, and it continues to be the
    subject of intensive research right up to the present day.  It
    lies at the core of a multitude of tools that are being used in
    academia and industry to specify and verify real software systems.

<div class="paragraph"> </div>

    Hoare Logic combines two beautiful ideas: a natural way of writing
    down <i>specifications</i> of programs, and a <i>compositional proof
    technique</i> for proving that programs are correct with respect to
    such specifications -- where by "compositional" we mean that the
    structure of proofs directly mirrors the structure of the programs
    that they are about. 
</div>

<div class="doc">
<a id="lab52"></a><h1 class="section">Assertions</h1>

<div class="paragraph"> </div>

 An <i>assertion</i> is a claim about the current state of memory. We will
    use assertions to write program specifications. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="Assertion" class="idref" href="#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span>.<br/>
</div>

<div class="doc">
For example,

<div class="paragraph"> </div>

<ul class="doclist">
<li> <span class="inlinecode"><span class="id" title="keyword">fun</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode">⇒</span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">3</span> holds if the value of <span class="inlinecode"><span class="id" title="var">X</span></span> according to <span class="inlinecode"><span class="id" title="var">st</span></span> is <span class="inlinecode">3</span>,

<div class="paragraph"> </div>


</li>
<li> <span class="inlinecode"><span class="id" title="keyword">fun</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode">⇒</span> <span class="inlinecode"><span class="id" title="var">True</span></span> always holds, and

<div class="paragraph"> </div>


</li>
<li> <span class="inlinecode"><span class="id" title="keyword">fun</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode">⇒</span> <span class="inlinecode"><span class="id" title="var">False</span></span> never holds. 
</li>
</ul>

<div class="paragraph"> </div>

<a id="lab53"></a><h4 class="section">Exercise: 1 star, standard, optional (assertions)</h4>
 Paraphrase the following assertions in English (or your favorite
    natural language). 
</div>
<div class="code">

<span class="id" title="keyword">Module</span> <a id="ExAssertions" class="idref" href="#ExAssertions"><span class="id" title="module">ExAssertions</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExAssertions.assn1" class="idref" href="#ExAssertions.assn1"><span class="id" title="definition">assn1</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="keyword">fun</span> <a id="st:1" class="idref" href="#st:1"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#st:1"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare.html#st:1"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Y</span>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExAssertions.assn2" class="idref" href="#ExAssertions.assn2"><span class="id" title="definition">assn2</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <a id="st:2" class="idref" href="#st:2"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#st:2"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> 3 <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#f031fe1957c4a4a8e217aa46af2b4e<sub>25</sub>"><span class="id" title="notation">∨</span></a> <a class="idref" href="Hoare.html#st:2"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare.html#st:2"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Y</span>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExAssertions.assn3" class="idref" href="#ExAssertions.assn3"><span class="id" title="definition">assn3</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <a id="st:3" class="idref" href="#st:3"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">(</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">(</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">(</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> (<a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Z</span>)<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">(</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> (<a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Z</span>)<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">)</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare.html#st:3"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExAssertions.assn4" class="idref" href="#ExAssertions.assn4"><span class="id" title="definition">assn4</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <a id="st:4" class="idref" href="#st:4"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#st:4"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.max"><span class="id" title="definition">max</span></a> (<a class="idref" href="Hoare.html#st:4"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span>) (<a class="idref" href="Hoare.html#st:4"><span class="id" title="variable">st</span></a> <span class="id" title="definition">Y</span>).<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#ExAssertions"><span class="id" title="module">ExAssertions</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

 This way of writing assertions can be a little bit heavy,
    for two reasons: (1) every single assertion that we ever write is
    going to begin with <span class="inlinecode"><span class="id" title="keyword">fun</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode">⇒</span> <span class="inlinecode"></span>; and (2) this state <span class="inlinecode"><span class="id" title="var">st</span></span> is the
    only one that we ever use to look up variables in assertions (we
    will never need to talk about two different memory states at the
    same time).  For discussing examples informally, we'll adopt some
    simplifying conventions: we'll drop the initial <span class="inlinecode"><span class="id" title="keyword">fun</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode">⇒</span>, and
    we'll write just <span class="inlinecode"><span class="id" title="var">X</span></span> to mean <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span>.  Thus, instead of writing 
<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒ <span class="id" title="var">st</span> <span class="id" title="var">X</span> = <span class="id" title="var">m</span>
</span>    we'll write just
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> = <span class="id" title="var">m</span>
</span>
<div class="paragraph"> </div>

 This example also illustrates a convention that we'll use
    throughout the Hoare Logic chapters: in informal assertions,
    capital letters like <span class="inlinecode"><span class="id" title="var">X</span></span>, <span class="inlinecode"><span class="id" title="var">Y</span></span>, and <span class="inlinecode"><span class="id" title="var">Z</span></span> are Imp variables, while
    lowercase letters like <span class="inlinecode"><span class="id" title="var">x</span></span>, <span class="inlinecode"><span class="id" title="var">y</span></span>, <span class="inlinecode"><span class="id" title="var">m</span></span>, and <span class="inlinecode"><span class="id" title="var">n</span></span> are ordinary Coq
    variables (of type <span class="inlinecode"><span class="id" title="var">nat</span></span>).  This is why, when translating from
    informal to formal, we replace <span class="inlinecode"><span class="id" title="var">X</span></span> with <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode"><span class="id" title="var">X</span></span> but leave <span class="inlinecode"><span class="id" title="var">m</span></span>
    alone. 
<div class="paragraph"> </div>

 Given two assertions <span class="inlinecode"><span class="id" title="var">P</span></span> and <span class="inlinecode"><span class="id" title="var">Q</span></span>, we say that <span class="inlinecode"><span class="id" title="var">P</span></span> <i>implies</i> <span class="inlinecode"><span class="id" title="var">Q</span></span>,
    written <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span class="id" title="var">Q</span></span>, if, whenever <span class="inlinecode"><span class="id" title="var">P</span></span> holds in some state <span class="inlinecode"><span class="id" title="var">st</span></span>, <span class="inlinecode"><span class="id" title="var">Q</span></span>
    also holds. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="assert_implies" class="idref" href="#assert_implies"><span class="id" title="definition">assert_implies</span></a> (<a id="P:5" class="idref" href="#P:5"><span class="id" title="binder">P</span></a> <a id="Q:6" class="idref" href="#Q:6"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:7" class="idref" href="#st:7"><span class="id" title="binder">st</span></a>, <a class="idref" href="Hoare.html#P:5"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:7"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#Q:6"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st:7"><span class="id" title="variable">st</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="var">Declare</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">hoare_spec_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::hoare_spec_scope:x_'-&gt;&gt;'_x" class="idref" href="#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation">&quot;</span></a>P <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> Q" := (<a class="idref" href="Hoare.html#assert_implies"><span class="id" title="definition">assert_implies</span></a> <span class="id" title="var">P</span> <span class="id" title="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 80) : <span class="id" title="var">hoare_spec_scope</span>.<br/>
<span class="id" title="keyword">Open</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
(The <span class="inlinecode"><span class="id" title="var">hoare_spec_scope</span></span> annotation here tells Coq that this
    notation is not global but is intended to be used in particular
    contexts.  The <span class="inlinecode"><span class="id" title="keyword">Open</span></span> <span class="inlinecode"><span class="id" title="keyword">Scope</span></span> tells Coq that this file is one such
    context.) 
<div class="paragraph"> </div>

 We'll also want the "iff" variant of implication between
    assertions: 
</div>
<div class="code">

<span class="id" title="keyword">Notation</span> <a id="::hoare_spec_scope:x_'&lt;&lt;-&gt;&gt;'_x" class="idref" href="#::hoare_spec_scope:x_'&lt;&lt;-&gt;&gt;'_x"><span class="id" title="notation">&quot;</span></a>P <span class="nowrap"><span style='font-size:85%;'><span style='letter-spacing:-.2em;'><<</span><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> Q" :=<br/>
&nbsp;&nbsp;(<span class="id" title="var">P</span> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">Q</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <span class="id" title="var">P</span>) (<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 80) : <span class="id" title="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
<a id="lab54"></a><h2 class="section">Notations for Assertions</h2>

<div class="paragraph"> </div>

 The convention described above can be implemented with a little
    Coq syntax magic, using coercions and annotation scopes, much as
    we did with <span class="inlinecode">%<span class="id" title="var">imp</span></span> in <a href="Imp.html"><span class="inlineref">Imp</span></a>, to automatically lift <span class="inlinecode"><span class="id" title="var">aexp</span></span>s,
    numbers, and <span class="inlinecode"><span class="id" title="keyword">Prop</span></span>s into <span class="inlinecode"><span class="id" title="var">Assertion</span></span>s when they appear in the
    <span class="inlinecode">%<span class="id" title="var">assertion</span></span> scope or when Coq knows the type of an expression is
    <span class="inlinecode"><span class="id" title="var">Assertion</span></span>.

<div class="paragraph"> </div>

    There is no need to understand the details. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="Aexp" class="idref" href="#Aexp"><span class="id" title="definition">Aexp</span></a> : <span class="id" title="keyword">Type</span> := <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="assert_of_Prop" class="idref" href="#assert_of_Prop"><span class="id" title="definition">assert_of_Prop</span></a> (<a id="P:8" class="idref" href="#P:8"><span class="id" title="binder">P</span></a> : <span class="id" title="keyword">Prop</span>) : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="keyword">fun</span> <span class="id" title="var">_</span> ⇒ <a class="idref" href="Hoare.html#P:8"><span class="id" title="variable">P</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="Aexp_of_nat" class="idref" href="#Aexp_of_nat"><span class="id" title="definition">Aexp_of_nat</span></a> (<a id="n:9" class="idref" href="#n:9"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a> := <span class="id" title="keyword">fun</span> <span class="id" title="var">_</span> ⇒ <a class="idref" href="Hoare.html#n:9"><span class="id" title="variable">n</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="Aexp_of_aexp" class="idref" href="#Aexp_of_aexp"><span class="id" title="definition">Aexp_of_aexp</span></a> (<a id="a:10" class="idref" href="#a:10"><span class="id" title="binder">a</span></a> : <span class="id" title="inductive">aexp</span>) : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a> := <span class="id" title="keyword">fun</span> <a id="st:11" class="idref" href="#st:11"><span class="id" title="binder">st</span></a> ⇒ <span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:11"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a:10"><span class="id" title="variable">a</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Coercion</span> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">assert_of_Prop</span></a> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">:</span></a> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">Sortclass</span></a> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">&gt;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span></a> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">Assertion</span></a>.<br/>
<span class="id" title="keyword">Coercion</span> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">Aexp_of_nat</span></a> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">:</span></a> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">nat</span></a> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">&gt;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span></a> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">Aexp</span></a>.<br/>
<span class="id" title="keyword">Coercion</span> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">Aexp_of_aexp</span></a> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">:</span></a> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">aexp</span></a> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">&gt;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span></a> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">Aexp</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="var">Arguments</span> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">assert_of_Prop</span></a> /.<br/>
<span class="id" title="var">Arguments</span> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">Aexp_of_nat</span></a> /.<br/>
<span class="id" title="var">Arguments</span> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">Aexp_of_aexp</span></a> /.<br/><hr class='doublespaceincode'/>
<span class="id" title="var">Declare</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Bind</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">assertion_scope</span> <span class="id" title="keyword">with</span> <span class="id" title="var">Assertion</span>.<br/>
<span class="id" title="keyword">Bind</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">assertion_scope</span> <span class="id" title="keyword">with</span> <span class="id" title="var">Aexp</span>.<br/>
<span class="id" title="keyword">Delimit</span> <span class="id" title="keyword">Scope</span> <span class="id" title="var">assertion_scope</span> <span class="id" title="keyword">with</span> <span class="id" title="var">assertion</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="assert" class="idref" href="#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> := (<span class="id" title="var">P</span>%<span class="id" title="var">assertion</span> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>).<br/>
<span class="id" title="keyword">Notation</span> <a id="mkAexp" class="idref" href="#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> := (<span class="id" title="var">a</span>%<span class="id" title="var">assertion</span> : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="90b84b70bae2a0cf52991d884e146143" class="idref" href="#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">&quot;</span></a>~ P" := (<span class="id" title="keyword">fun</span> <a id="st:12" class="idref" href="#st:12"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> <a class="idref" href="Hoare.html#st:12"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="cce4ad113420d0c25c6ce4891bbe5028" class="idref" href="#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">&quot;</span></a>P /\ Q" := (<span class="id" title="keyword">fun</span> <a id="st:13" class="idref" href="#st:13"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> <a class="idref" href="Hoare.html#st:13"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#st:13"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="71acda7c05013ec3b4ea9870c5591533" class="idref" href="#71acda7c05013ec3b4ea9870c5591533"><span class="id" title="notation">&quot;</span></a>P \/ Q" := (<span class="id" title="keyword">fun</span> <a id="st:14" class="idref" href="#st:14"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> <a class="idref" href="Hoare.html#st:14"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#f031fe1957c4a4a8e217aa46af2b4e<sub>25</sub>"><span class="id" title="notation">∨</span></a> <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#st:14"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'-&gt;'_x" class="idref" href="#::assertion_scope:x_'-&gt;'_x"><span class="id" title="notation">&quot;</span></a>P <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> Q" := (<span class="id" title="keyword">fun</span> <a id="st:15" class="idref" href="#st:15"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> <a class="idref" href="Hoare.html#st:15"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a>  <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#st:15"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'&lt;-&gt;'_x" class="idref" href="#::assertion_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">&quot;</span></a>P &lt;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> Q" := (<span class="id" title="keyword">fun</span> <a id="st:16" class="idref" href="#st:16"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">P</span> <a class="idref" href="Hoare.html#st:16"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'&lt;-&gt;'_x"><span class="id" title="notation">↔</span></a>  <a class="idref" href="Hoare.html#assert"><span class="id" title="abbreviation">assert</span></a> <span class="id" title="var">Q</span> <a class="idref" href="Hoare.html#st:16"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="5ad5c240a08c2b567f422c2e12577e<sub>27</sub>" class="idref" href="#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">&quot;</span></a>a = b" := (<span class="id" title="keyword">fun</span> <a id="st:17" class="idref" href="#st:17"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:17"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:17"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'&lt;&gt;'_x" class="idref" href="#::assertion_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">&quot;</span></a>a &lt;&gt; b" := (<span class="id" title="keyword">fun</span> <a id="st:18" class="idref" href="#st:18"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:18"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'&lt;&gt;'_x"><span class="id" title="notation">≠</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:18"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="154e85acf24eb57aa8f8a0156c0ba632" class="idref" href="#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">&quot;</span></a>a &lt;= b" := (<span class="id" title="keyword">fun</span> <a id="st:19" class="idref" href="#st:19"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:19"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#cb53cf0ee22c036a03b4a9281c68b5a<sub>3</sub>"><span class="id" title="notation">≤</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:19"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'&lt;'_x" class="idref" href="#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&quot;</span></a>a &lt; b" := (<span class="id" title="keyword">fun</span> <a id="st:20" class="idref" href="#st:20"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:20"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#::nat_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:20"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="47f7df8f7d756435423005da8ec23e<sub>41</sub>" class="idref" href="#47f7df8f7d756435423005da8ec23e<sub>41</sub>"><span class="id" title="notation">&quot;</span></a>a &gt;= b" := (<span class="id" title="keyword">fun</span> <a id="st:21" class="idref" href="#st:21"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:21"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#73030c22bc0b1fa771c65aa5414c65f<sub>9</sub>"><span class="id" title="notation">≥</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:21"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'&gt;'_x" class="idref" href="#::assertion_scope:x_'&gt;'_x"><span class="id" title="notation">&quot;</span></a>a &gt; b" := (<span class="id" title="keyword">fun</span> <a id="st:22" class="idref" href="#st:22"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:22"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Peano.html#::nat_scope:x_'&gt;'_x"><span class="id" title="notation">&gt;</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:22"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="d7f322243320be10cf04dfecd9fa5876" class="idref" href="#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">&quot;</span></a>a + b" := (<span class="id" title="keyword">fun</span> <a id="st:23" class="idref" href="#st:23"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:23"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#0dacc1786c5ba797d47dd85006231633"><span class="id" title="notation">+</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:23"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="::assertion_scope:x_'-'_x" class="idref" href="#::assertion_scope:x_'-'_x"><span class="id" title="notation">&quot;</span></a>a - b" := (<span class="id" title="keyword">fun</span> <a id="st:24" class="idref" href="#st:24"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:24"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#::nat_scope:x_'-'_x"><span class="id" title="notation">-</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:24"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
<span class="id" title="keyword">Notation</span> <a id="416660177ea0e5c9120e6d5bca0fb24e" class="idref" href="#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">&quot;</span></a>a * b" := (<span class="id" title="keyword">fun</span> <a id="st:25" class="idref" href="#st:25"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">a</span> <a class="idref" href="Hoare.html#st:25"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Nat.html#ea2ff3d561159081cea6fb2e8113cc<sub>54</sub>"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#mkAexp"><span class="id" title="abbreviation">mkAexp</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#st:25"><span class="id" title="variable">st</span></a>) : <span class="id" title="var">assertion_scope</span>.<br/>
</div>

<div class="doc">
One small limitation of this approach is that we don't have
    an automatic way to coerce function applications that appear
    within an assertion to make appropriate use of the state.
    Instead, we use an explicit <span class="inlinecode"><span class="id" title="var">ap</span></span> operator to lift the function. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="ap" class="idref" href="#ap"><span class="id" title="definition">ap</span></a> {<a id="X:26" class="idref" href="#X:26"><span class="id" title="binder">X</span></a>} (<a id="f:27" class="idref" href="#f:27"><span class="id" title="binder">f</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#X:26"><span class="id" title="variable">X</span></a>) (<a id="x:28" class="idref" href="#x:28"><span class="id" title="binder">x</span></a> : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a>) :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <a id="st:29" class="idref" href="#st:29"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#f:27"><span class="id" title="variable">f</span></a> (<a class="idref" href="Hoare.html#x:28"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#st:29"><span class="id" title="variable">st</span></a>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="ap<sub>2</sub>" class="idref" href="#ap<sub>2</sub>"><span class="id" title="definition">ap<sub>2</sub></span></a> {<a id="X:30" class="idref" href="#X:30"><span class="id" title="binder">X</span></a>} (<a id="f:31" class="idref" href="#f:31"><span class="id" title="binder">f</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#X:30"><span class="id" title="variable">X</span></a>) (<a id="x:32" class="idref" href="#x:32"><span class="id" title="binder">x</span></a> : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a>) (<a id="y:33" class="idref" href="#y:33"><span class="id" title="binder">y</span></a> : <a class="idref" href="Hoare.html#Aexp"><span class="id" title="definition">Aexp</span></a>) (<a id="st:34" class="idref" href="#st:34"><span class="id" title="binder">st</span></a> : <span class="id" title="definition">state</span>) :=<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#f:31"><span class="id" title="variable">f</span></a> (<a class="idref" href="Hoare.html#x:32"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#st:34"><span class="id" title="variable">st</span></a>) (<a class="idref" href="Hoare.html#y:33"><span class="id" title="variable">y</span></a> <a class="idref" href="Hoare.html#st:34"><span class="id" title="variable">st</span></a>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Module</span> <a id="ExPrettyAssertions" class="idref" href="#ExPrettyAssertions"><span class="id" title="module">ExPrettyAssertions</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.ex1" class="idref" href="#ExPrettyAssertions.ex1"><span class="id" title="definition">ex<sub>1</sub></span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 3.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.ex2" class="idref" href="#ExPrettyAssertions.ex2"><span class="id" title="definition">ex<sub>2</sub></span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.ex3" class="idref" href="#ExPrettyAssertions.ex3"><span class="id" title="definition">ex<sub>3</sub></span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#False"><span class="id" title="inductive">False</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.assn1" class="idref" href="#ExPrettyAssertions.assn1"><span class="id" title="definition">assn1</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.assn2" class="idref" href="#ExPrettyAssertions.assn2"><span class="id" title="definition">assn2</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> := <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 3 <a class="idref" href="Hoare.html#71acda7c05013ec3b4ea9870c5591533"><span class="id" title="notation">∨</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.assn3" class="idref" href="#ExPrettyAssertions.assn3"><span class="id" title="definition">assn3</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span>  <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a>  <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">×</span></a> <a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ap"><span class="id" title="definition">ap</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#S"><span class="id" title="constructor">S</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#416660177ea0e5c9120e6d5bca0fb24e"><span class="id" title="notation">)</span></a><a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Definition</span> <a id="ExPrettyAssertions.assn4" class="idref" href="#ExPrettyAssertions.assn4"><span class="id" title="definition">assn4</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#ap<sub>2</sub>"><span class="id" title="definition">ap<sub>2</sub></span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.max"><span class="id" title="definition">max</span></a> <span class="id" title="definition">X</span> <span class="id" title="definition">Y</span>.<br/>
<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#ExPrettyAssertions"><span class="id" title="module">ExPrettyAssertions</span></a>.<br/>
</div>

<div class="doc">
<a id="lab55"></a><h1 class="section">Hoare Triples, Informally</h1>

<div class="paragraph"> </div>

 A <i>Hoare triple</i> is a claim about the state before and after executing
    a command.  A standard notation is
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<span class="id" title="var">P</span>} <span class="id" title="var">c</span> {<span class="id" title="var">Q</span>}
</span>    meaning:

<div class="paragraph"> </div>

<ul class="doclist">
<li> If command <span class="inlinecode"><span class="id" title="var">c</span></span> begins execution in a state satisfying assertion <span class="inlinecode"><span class="id" title="var">P</span></span>,

</li>
<li> and if <span class="inlinecode"><span class="id" title="var">c</span></span> eventually terminates in some final state,

</li>
<li> then that final state will satisfy the assertion <span class="inlinecode"><span class="id" title="var">Q</span></span>.

</li>
</ul>

<div class="paragraph"> </div>

    Assertion <span class="inlinecode"><span class="id" title="var">P</span></span> is called the <i>precondition</i> of the triple, and <span class="inlinecode"><span class="id" title="var">Q</span></span> is
    the <i>postcondition</i>.

<div class="paragraph"> </div>

    Because single braces are already used for other things in Coq, we'll write
    Hoare triples with double braces:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}
</span>  For example,

<div class="paragraph"> </div>

<ul class="doclist">
<li> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0<span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1<span style='letter-spacing:-.4em;'>}</span>}</span> is a valid Hoare triple,
      stating that command <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> would transform a state in
      which <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> to a state in which <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>.

<div class="paragraph"> </div>


</li>
<li> <span class="inlinecode"><span class="id" title="keyword">∀</span></span> <span class="inlinecode"><span class="id" title="var">m</span>,</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1<span style='letter-spacing:-.4em;'>}</span>}</span>, is a
      <i>proposition</i> stating that the Hoare triple <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span>
      <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">m</span></span> <span class="inlinecode">×</span> <span class="inlinecode">2<span style='letter-spacing:-.4em;'>}</span>}</span>) is valid for any choice of <span class="inlinecode"><span class="id" title="var">m</span></span>.  Note that <span class="inlinecode"><span class="id" title="var">m</span></span>
      in the two assertions and the command in the middle is a
      reference to the Coq variable <span class="inlinecode"><span class="id" title="var">m</span></span>, which is bound outside the
      Hoare triple, not to an Imp variable. 
</li>
</ul>

<div class="paragraph"> </div>

<a id="lab56"></a><h4 class="section">Exercise: 1 star, standard, optional (triples)</h4>
 Paraphrase the following in English.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2) <span class="id" title="keyword">∀</span> <span class="id" title="var">m</span>, <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = <span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = <span class="id" title="var">m</span> + 5)<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Y</span> ≤ <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;5) <span class="id" title="keyword">∀</span> <span class="id" title="var">m</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = <span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">c</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Y</span> = <span class="id" title="var">real_fact</span> <span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;6) <span class="id" title="keyword">∀</span> <span class="id" title="var">m</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = <span class="id" title="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">c</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" title="var">Z</span> × <span class="id" title="var">Z</span>) ≤ <span class="id" title="var">m</span> ∧ ¬(((<span class="id" title="var">S</span> <span class="id" title="var">Z</span>) × (<span class="id" title="var">S</span> <span class="id" title="var">Z</span>)) ≤ <span class="id" title="var">m</span>)<span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab57"></a><h4 class="section">Exercise: 1 star, standard, optional (valid_triples)</h4>
 Which of the following Hoare triples are <i>valid</i> -- i.e., the
    claimed relation between <span class="inlinecode"><span class="id" title="var">P</span></span>, <span class="inlinecode"><span class="id" title="var">c</span></span>, and <span class="inlinecode"><span class="id" title="var">Q</span></span> is true?
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;1) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := 5 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;2) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 2<span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 3<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;3) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := 5; <span class="id" title="var">Y</span> := 0 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;4) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 2 ∧ <span class="id" title="var">X</span> = 3<span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := 5 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 0<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;5) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;6) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">False</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;7) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">while</span> <span class="id" title="var">true</span> <span class="id" title="tactic">do</span> <span class="id" title="var">skip</span> <span class="id" title="keyword">end</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;8) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 0<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">X</span> = 0 <span class="id" title="tactic">do</span> <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1 <span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 1<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;9) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 1<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> ~(<span class="id" title="var">X</span> = 0) <span class="id" title="tactic">do</span> <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1 <span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 100<span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab58"></a><h1 class="section">Hoare Triples, Formally</h1>

<div class="paragraph"> </div>

 We can formalize Hoare triples and their notation in Coq as follows: 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="hoare_triple" class="idref" href="#hoare_triple"><span class="id" title="definition">hoare_triple</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a id="P:35" class="idref" href="#P:35"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="c:36" class="idref" href="#c:36"><span class="id" title="binder">c</span></a> : <span class="id" title="inductive">com</span>) (<a id="Q:37" class="idref" href="#Q:37"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:38" class="idref" href="#st:38"><span class="id" title="binder">st</span></a> <a id="st':39" class="idref" href="#st':39"><span class="id" title="binder">st'</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:38"><span class="id" title="variable">st</span></a> <span class="id" title="notation">=[</span> <a class="idref" href="Hoare.html#c:36"><span class="id" title="variable">c</span></a> <span class="id" title="notation">]=&gt;</span> <a class="idref" href="Hoare.html#st':39"><span class="id" title="variable">st'</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:35"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:38"><span class="id" title="variable">st</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q:37"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st':39"><span class="id" title="variable">st'</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="a18cbce9fe584a9130c3f34d4f14555f" class="idref" href="#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="var">P</span> <span class="id" title="var">c</span> <span class="id" title="var">Q</span>) (<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99)<br/>
&nbsp;&nbsp;: <span class="id" title="var">hoare_spec_scope</span>.<br/>
<span class="id" title="keyword">Check</span> (<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 0 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>).<br/>
</div>

<div class="doc">
<a id="lab59"></a><h4 class="section">Exercise: 1 star, standard (hoare_post_true)</h4>

<div class="paragraph"> </div>

 Prove that if <span class="inlinecode"><span class="id" title="var">Q</span></span> holds in every state, then any triple with <span class="inlinecode"><span class="id" title="var">Q</span></span>
    as its postcondition is valid. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_post_true" class="idref" href="#hoare_post_true"><span class="id" title="lemma">hoare_post_true</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:40" class="idref" href="#P:40"><span class="id" title="binder">P</span></a> <a id="Q:41" class="idref" href="#Q:41"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:42" class="idref" href="#c:42"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><span class="id" title="keyword">∀</span> <a id="st:43" class="idref" href="#st:43"><span class="id" title="binder">st</span></a>, <a class="idref" href="Hoare.html#Q:41"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st:43"><span class="id" title="variable">st</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:40"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:42"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:41"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab60"></a><h4 class="section">Exercise: 1 star, standard (hoare_pre_false)</h4>

<div class="paragraph"> </div>

 Prove that if <span class="inlinecode"><span class="id" title="var">P</span></span> holds in no state, then any triple with <span class="inlinecode"><span class="id" title="var">P</span></span> as
    its precondition is valid. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_pre_false" class="idref" href="#hoare_pre_false"><span class="id" title="lemma">hoare_pre_false</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:44" class="idref" href="#P:44"><span class="id" title="binder">P</span></a> <a id="Q:45" class="idref" href="#Q:45"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:46" class="idref" href="#c:46"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><span class="id" title="keyword">∀</span> <a id="st:47" class="idref" href="#st:47"><span class="id" title="binder">st</span></a>, <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#P:44"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:47"><span class="id" title="variable">st</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">)</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:44"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:46"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:45"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab61"></a><h1 class="section">Proof Rules</h1>

<div class="paragraph"> </div>

 The goal of Hoare logic is to provide a <i>compositional</i>
    method for proving the validity of specific Hoare triples.  That
    is, we want the structure of a program's correctness proof to
    mirror the structure of the program itself.  To this end, in the
    sections below, we'll introduce a rule for reasoning about each of
    the different syntactic forms of commands in Imp -- one for
    assignment, one for sequencing, one for conditionals, etc. -- plus
    a couple of "structural" rules for gluing things together.  We
    will then be able to prove programs correct using these proof
    rules, without ever unfolding the definition of <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span>. 
</div>

<div class="doc">
<a id="lab62"></a><h2 class="section">Assignment</h2>

<div class="paragraph"> </div>

 The rule for assignment is the most fundamental of the Hoare
    logic proof rules.  Here's how it works.

<div class="paragraph"> </div>

    Consider this incomplete Hoare triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ ??? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

    We want to assign <span class="inlinecode"><span class="id" title="var">Y</span></span> to <span class="inlinecode"><span class="id" title="var">X</span></span> and finish in a state where <span class="inlinecode"><span class="id" title="var">X</span></span> is <span class="inlinecode">1</span>.
    What could the precondition be?

<div class="paragraph"> </div>

    One possibility is <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>, because if <span class="inlinecode"><span class="id" title="var">Y</span></span> is already <span class="inlinecode">1</span> then
    assigning it to <span class="inlinecode"><span class="id" title="var">X</span></span> causes <span class="inlinecode"><span class="id" title="var">X</span></span> to be <span class="inlinecode">1</span>.  That leads to a valid
    Hoare triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">Y</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}
</span>    It may seem as though coming up with that precondition must have
    taken some clever thought.  But there is a mechanical way we could
    have done it: if we take the postcondition <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span> and in it
    replace <span class="inlinecode"><span class="id" title="var">X</span></span> with <span class="inlinecode"><span class="id" title="var">Y</span></span>---that is, replace the left-hand side of the
    assignment statement with the right-hand side---we get the
    precondition, <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>. 
<div class="paragraph"> </div>

 That same idea works in more complicated cases.  For
    example:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ ??? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Y</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}
</span>    If we replace the <span class="inlinecode"><span class="id" title="var">X</span></span> in <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span> with <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">Y</span></span>, we get <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>.
    That again leads to a valid Hoare triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> + <span class="id" title="var">Y</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Y</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}
</span>    Why does this technique work?  The postcondition identifies some
    property <span class="inlinecode"><span class="id" title="var">P</span></span> that we want to hold of the variable <span class="inlinecode"><span class="id" title="var">X</span></span> being
    assigned.  In this case, <span class="inlinecode"><span class="id" title="var">P</span></span> is "equals <span class="inlinecode">1</span>".  To complete the
    triple and make it valid, we need to identify a precondition that
    guarantees that property will hold of <span class="inlinecode"><span class="id" title="var">X</span></span>.  Such a precondition
    must ensure that the same property holds of <i>whatever is being
    assigned to</i> <span class="inlinecode"><span class="id" title="var">X</span></span>.  So, in the example, we need "equals <span class="inlinecode">1</span>" to
    hold of <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" title="var">Y</span></span>.  That's exactly what the technique guarantees. 
<div class="paragraph"> </div>

 In general, the postcondition could be some arbitrary assertion
    <span class="inlinecode"><span class="id" title="var">Q</span></span>, and the right-hand side of the assignment could be some
    arbitrary arithmetic expression <span class="inlinecode"><span class="id" title="var">a</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ ??? <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">a</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    The precondition would then be <span class="inlinecode"><span class="id" title="var">Q</span></span>, but with any occurrences of
    <span class="inlinecode"><span class="id" title="var">X</span></span> in it replaced by <span class="inlinecode"><span class="id" title="var">a</span></span>.

<div class="paragraph"> </div>

    Let's introduce a notation for this idea of replacing occurrences:
    Define <span class="inlinecode"><span class="id" title="var">Q</span></span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" title="var">a</span>]</span> to mean "<span class="inlinecode"><span class="id" title="var">Q</span></span> where <span class="inlinecode"><span class="id" title="var">a</span></span> is substituted in
    place of <span class="inlinecode"><span class="id" title="var">X</span></span>".

<div class="paragraph"> </div>

    That yields the Hoare logic rule for assignment:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">a</span>] <span style='letter-spacing:-.4em;'>}</span>}  <span class="id" title="var">X</span> := <span class="id" title="var">a</span>  <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    One way of reading that rule is: If you want statement <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">a</span></span>
    to terminate in a state that satisfies assertion <span class="inlinecode"><span class="id" title="var">Q</span></span>, then it
    suffices to start in a state that also satisfies <span class="inlinecode"><span class="id" title="var">Q</span></span>, except
    where <span class="inlinecode"><span class="id" title="var">a</span></span> is substituted for every occurrence of <span class="inlinecode"><span class="id" title="var">X</span></span>.

<div class="paragraph"> </div>

    To many people, this rule seems "backwards" at first, because
    it proceeds from the postcondition to the precondition.  Actually
    it makes good sense to go in this direction: the postcondition is
    often what is more important, because it characterizes what we
    can assume afer running the code.

<div class="paragraph"> </div>

    Nonetheless, it's also possible to formulate a "forward" assignment
    rule.  We'll do that later in some exercises. 
<div class="paragraph"> </div>

 Here are some valid instances of the assignment rule:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">X</span> ≤ 5) [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">X</span> + 1] <span style='letter-spacing:-.4em;'>}</span>}     (<span class="id" title="var">that</span> <span class="id" title="keyword">is</span>, <span class="id" title="var">X</span> + 1 ≤ 5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> ≤ 5 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">X</span> = 3) [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> 3] <span style='letter-spacing:-.4em;'>}</span>}          (<span class="id" title="var">that</span> <span class="id" title="keyword">is</span>, 3 = 3)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 3 <span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (0 ≤ <span class="id" title="var">X</span> ∧ <span class="id" title="var">X</span> ≤ 5) [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> 3]  (<span class="id" title="var">that</span> <span class="id" title="keyword">is</span>, 0 ≤ 3 ∧ 3 ≤ 5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 0 ≤ <span class="id" title="var">X</span> ∧ <span class="id" title="var">X</span> ≤ 5 <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 To formalize the rule, we must first formalize the idea of
    "substituting an expression for an Imp variable in an assertion",
    which we refer to as assertion substitution, or <span class="inlinecode"><span class="id" title="var">assn_sub</span></span>.  That
    is, given a proposition <span class="inlinecode"><span class="id" title="var">P</span></span>, a variable <span class="inlinecode"><span class="id" title="var">X</span></span>, and an arithmetic
    expression <span class="inlinecode"><span class="id" title="var">a</span></span>, we want to derive another proposition <span class="inlinecode"><span class="id" title="var">P'</span></span> that is
    just the same as <span class="inlinecode"><span class="id" title="var">P</span></span> except that <span class="inlinecode"><span class="id" title="var">P'</span></span> should mention <span class="inlinecode"><span class="id" title="var">a</span></span> wherever
    <span class="inlinecode"><span class="id" title="var">P</span></span> mentions <span class="inlinecode"><span class="id" title="var">X</span></span>. 
<div class="paragraph"> </div>

 Since <span class="inlinecode"><span class="id" title="var">P</span></span> is an arbitrary Coq assertion, we can't directly "edit"
    its text.  However, we can achieve the same effect by evaluating
    <span class="inlinecode"><span class="id" title="var">P</span></span> in an updated state: 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="assn_sub" class="idref" href="#assn_sub"><span class="id" title="definition">assn_sub</span></a> <a id="X:48" class="idref" href="#X:48"><span class="id" title="binder">X</span></a> <a id="a:49" class="idref" href="#a:49"><span class="id" title="binder">a</span></a> (<a id="P:50" class="idref" href="#P:50"><span class="id" title="binder">P</span></a>:<a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> (<a id="st:51" class="idref" href="#st:51"><span class="id" title="binder">st</span></a> : <span class="id" title="definition">state</span>) ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:50"><span class="id" title="variable">P</span></a> (<a class="idref" href="Hoare.html#X:48"><span class="id" title="variable">X</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:51"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a:49"><span class="id" title="variable">a</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:51"><span class="id" title="variable">st</span></a>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="bf32e07a6a6f21756fecc93ac97674bb" class="idref" href="#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">&quot;</span></a>P [ X <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> a ]" := (<a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">P</span>)<br/>
&nbsp;&nbsp;(<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 10, <span class="id" title="var">X</span> <span class="id" title="tactic">at</span> <span class="id" title="var">next</span> <span class="id" title="keyword">level</span>, <span class="id" title="var">a</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span>).<br/>
</div>

<div class="doc">
That is, <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" title="var">a</span>]</span> stands for an assertion -- let's call it <span class="inlinecode"><span class="id" title="var">P'</span></span> --
    that is just like <span class="inlinecode"><span class="id" title="var">P</span></span> except that, wherever <span class="inlinecode"><span class="id" title="var">P</span></span> looks up the
    variable <span class="inlinecode"><span class="id" title="var">X</span></span> in the current state, <span class="inlinecode"><span class="id" title="var">P'</span></span> instead uses the value
    of the expression <span class="inlinecode"><span class="id" title="var">a</span></span>. 
<div class="paragraph"> </div>

 To see how this works, let's calculate what happens with a couple
    of examples.  First, suppose <span class="inlinecode"><span class="id" title="var">P'</span></span> is <span class="inlinecode">(<span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5)</span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode">3]</span> -- that
    is, more formally, <span class="inlinecode"><span class="id" title="var">P'</span></span> is the Coq expression
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">fun</span> <span class="id" title="var">st'</span> ⇒ <span class="id" title="var">st'</span> <span class="id" title="var">X</span> ≤ 5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" title="var">aeval</span> <span class="id" title="var">st</span> 3 ; <span class="id" title="var">st</span>),
</span>    which simplifies to
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">fun</span> <span class="id" title="var">st'</span> ⇒ <span class="id" title="var">st'</span> <span class="id" title="var">X</span> ≤ 5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> 3 ; <span class="id" title="var">st</span>)
</span>    and further simplifies to
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="id" title="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> 3 ; <span class="id" title="var">st</span>) <span class="id" title="var">X</span>) ≤ 5
</span>    and finally to
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3 ≤ 5.
</span>    That is, <span class="inlinecode"><span class="id" title="var">P'</span></span> is the assertion that <span class="inlinecode">3</span> is less than or equal to
    <span class="inlinecode">5</span> (as expected). 
<div class="paragraph"> </div>

 For a more interesting example, suppose <span class="inlinecode"><span class="id" title="var">P'</span></span> is <span class="inlinecode">(<span class="id" title="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5)</span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span>
    <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1]</span>.  Formally, <span class="inlinecode"><span class="id" title="var">P'</span></span> is the Coq expression
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">fun</span> <span class="id" title="var">st'</span> ⇒ <span class="id" title="var">st'</span> <span class="id" title="var">X</span> ≤ 5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" title="var">aeval</span> <span class="id" title="var">st</span> (<span class="id" title="var">X</span> + 1) ; <span class="id" title="var">st</span>),
</span>    which simplifies to
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" title="var">aeval</span> <span class="id" title="var">st</span> (<span class="id" title="var">X</span> + 1) ; <span class="id" title="var">st</span>) <span class="id" title="var">X</span> ≤ 5
</span>    and further simplifies to
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="var">aeval</span> <span class="id" title="var">st</span> (<span class="id" title="var">X</span> + 1)) ≤ 5.
</span>    That is, <span class="inlinecode"><span class="id" title="var">P'</span></span> is the assertion that <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> is at most <span class="inlinecode">5</span>.

<div class="paragraph"> </div>

 Now, using the concept of substitution, we can give the precise
    proof rule for assignment:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{Q [X <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> a]<span style='letter-spacing:-.4em;'>}</span>} X := a <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 We can prove formally that this rule is indeed valid. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_asgn" class="idref" href="#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a> : <span class="id" title="keyword">∀</span> <a id="Q:52" class="idref" href="#Q:52"><span class="id" title="binder">Q</span></a> <a id="X:53" class="idref" href="#X:53"><span class="id" title="binder">X</span></a> <a id="a:54" class="idref" href="#a:54"><span class="id" title="binder">a</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:52"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><a class="idref" href="Hoare.html#X:53"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <a class="idref" href="Hoare.html#a:54"><span class="id" title="variable">a</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#X:53"><span class="id" title="variable">X</span></a> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare.html#a:54"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:52"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')"><span class="show"></span></div>
<div class="proofscript" id="proof1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">Q</span> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">HE</span> <span class="id" title="var">HQ</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">HE</span>. <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">HQ</span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Here's a first formal proof using this rule. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="assn_sub_example" class="idref" href="#assn_sub_example"><span class="id" title="definition">assn_sub_example</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
(Of course, what we'd probably prefer is to prove this
    simpler triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> &lt; 4<span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> &lt; 5<span style='letter-spacing:-.4em;'>}</span>}
</span>   We will see how to do so in the next section. 
<div class="paragraph"> </div>

 Complete these Hoare triples by providing an appropriate
    precondition using <span class="inlinecode"><span class="id" title="tactic">∃</span></span>, then prove then with <span class="inlinecode"><span class="id" title="tactic">apply</span></span>
    <span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span>. If you find that tactic doesn't suffice, double check
    that you have completed the triple properly. <a id="lab63"></a><h4 class="section">Exercise: 2 stars, standard, optional (hoare_asgn_examples1)</h4>

</div>
<div class="code">
<span class="id" title="keyword">Example</span> <a id="hoare_asgn_examples1" class="idref" href="#hoare_asgn_examples1"><span class="id" title="definition">hoare_asgn_examples1</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a id="P:55" class="idref" href="#P:55"><span class="id" title="binder">P</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">,</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:55"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 2 <span class="id" title="notation">×</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 10 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab64"></a><h4 class="section">Exercise: 2 stars, standard, optional (hoare_asgn_examples2)</h4>

</div>
<div class="code">
<span class="id" title="keyword">Example</span> <a id="hoare_asgn_examples2" class="idref" href="#hoare_asgn_examples2"><span class="id" title="definition">hoare_asgn_examples2</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a id="P:56" class="idref" href="#P:56"><span class="id" title="binder">P</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">,</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:56"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 0 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a>  <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 5 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab65"></a><h4 class="section">Exercise: 2 stars, standard, especially useful (hoare_asgn_wrong)</h4>
 The assignment rule looks backward to almost everyone the first
    time they see it.  If it still seems puzzling to you, it may help
    to think a little about alternative "forward" rules.  Here is a
    seemingly natural one:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_wrong) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ True <span style='letter-spacing:-.4em;'>}</span>} X := a <span style='letter-spacing:-.4em;'>{</span>{ X = a <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>    Give a counterexample showing that this rule is incorrect and
    argue informally that it is really a counterexample.  (Hint:
    The rule universally quantifies over the arithmetic expression
    <span class="inlinecode"><span class="id" title="var">a</span></span>, and your counterexample needs to exhibit an <span class="inlinecode"><span class="id" title="var">a</span></span> for which
    the rule doesn't work.) 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_hoare_asgn_wrong" class="idref" href="#manual_grade_for_hoare_asgn_wrong"><span class="id" title="definition">manual_grade_for_hoare_asgn_wrong</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab66"></a><h4 class="section">Exercise: 3 stars, advanced (hoare_asgn_fwd)</h4>
 However, by using a <i>parameter</i> <span class="inlinecode"><span class="id" title="var">m</span></span> (a Coq number) to remember the
    original value of <span class="inlinecode"><span class="id" title="var">X</span></span> we can define a Hoare rule for assignment
    that does, intuitively, "work forwards" rather than backwards.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_fwd) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun st => P st /\ st X = m<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">X := a</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun st => P st' /\ st X = aeval st' a <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">(where st' = (X !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> m ; st))</td>
  <td></td>
</td>
</table></center>    Note that we use the original value of <span class="inlinecode"><span class="id" title="var">X</span></span> to reconstruct the
    state <span class="inlinecode"><span class="id" title="var">st'</span></span> before the assignment took place. Prove that this rule
    is correct.  (Also note that this rule is more complicated than
    <span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span>.) 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_asgn_fwd" class="idref" href="#hoare_asgn_fwd"><span class="id" title="lemma">hoare_asgn_fwd</span></a> :<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="m:57" class="idref" href="#m:57"><span class="id" title="binder">m</span></a> <a id="a:58" class="idref" href="#a:58"><span class="id" title="binder">a</span></a> <a id="P:59" class="idref" href="#P:59"><span class="id" title="binder">P</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="keyword">fun</span> <a id="st:60" class="idref" href="#st:60"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#P:59"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:60"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#st:60"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#m:57"><span class="id" title="variable">m</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare.html#a:58"><span class="id" title="variable">a</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="keyword">fun</span> <a id="st:61" class="idref" href="#st:61"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#P:59"><span class="id" title="variable">P</span></a> (<span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#m:57"><span class="id" title="variable">m</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:61"><span class="id" title="variable">st</span></a>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#st:61"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="definition">aeval</span> (<span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#m:57"><span class="id" title="variable">m</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:61"><span class="id" title="variable">st</span></a>) <a class="idref" href="Hoare.html#a:58"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab67"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_asgn_fwd_exists)</h4>
 Another way to define a forward rule for assignment is to
    existentially quantify over the previous value of the assigned
    variable.  Prove that it is correct.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_fwd_exists) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun st => P st<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">X := a</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun st => exists m, P (X !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> m ; st) /\</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">st X = aeval (X !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> m ; st) a <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_asgn_fwd_exists" class="idref" href="#hoare_asgn_fwd_exists"><span class="id" title="lemma">hoare_asgn_fwd_exists</span></a> :<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="a:62" class="idref" href="#a:62"><span class="id" title="binder">a</span></a> <a id="P:63" class="idref" href="#P:63"><span class="id" title="binder">P</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="keyword">fun</span> <a id="st:64" class="idref" href="#st:64"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="Hoare.html#P:63"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:64"><span class="id" title="variable">st</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare.html#a:62"><span class="id" title="variable">a</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="keyword">fun</span> <a id="st:65" class="idref" href="#st:65"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a id="m:66" class="idref" href="#m:66"><span class="id" title="binder">m</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">,</span></a> <a class="idref" href="Hoare.html#P:63"><span class="id" title="variable">P</span></a> (<span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#m:66"><span class="id" title="variable">m</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:65"><span class="id" title="variable">st</span></a>) <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:65"><span class="id" title="variable">st</span></a> <span class="id" title="definition">X</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="definition">aeval</span> (<span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#m:66"><span class="id" title="variable">m</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:65"><span class="id" title="variable">st</span></a>) <a class="idref" href="Hoare.html#a:62"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab68"></a><h2 class="section">Consequence</h2>

<div class="paragraph"> </div>

 Sometimes the preconditions and postconditions we get from the
    Hoare rules won't quite be the ones we want in the particular
    situation at hand -- they may be logically equivalent but have a
    different syntactic form that fails to unify with the goal we are
    trying to prove, or they actually may be logically weaker (for
    preconditions) or stronger (for postconditions) than what we need. 
<div class="paragraph"> </div>

 For instance, while
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" title="var">X</span> = 3) [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> 3]<span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := 3 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 3<span style='letter-spacing:-.4em;'>}</span>},
</span>    follows directly from the assignment rule,
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">X</span> := 3 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> = 3<span style='letter-spacing:-.4em;'>}</span>}
</span>    does not.  This triple is valid, but it is not an instance of
    <span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span> because <span class="inlinecode"><span class="id" title="var">True</span></span> and <span class="inlinecode">(<span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">3)</span> <span class="inlinecode">[<span class="id" title="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode">3]</span> are not
    syntactically equal assertions.  However, they are logically
    <i>equivalent</i>, so if one triple is valid, then the other must
    certainly be as well.  We can capture this observation with the
    following rule:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='letter-spacing:-.2em;'><<</span><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> P'</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_pre_equiv) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 Taking this line of thought a bit further, we can see that
    strengthening the precondition or weakening the postcondition of a
    valid triple always produces another valid triple. This
    observation is captured by two <i>Rules of Consequence</i>.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> P'</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_pre) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q'<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">Q' <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> Q</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_post) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 Here are the formal versions: 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_pre" class="idref" href="#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:67" class="idref" href="#P:67"><span class="id" title="binder">P</span></a> <a id="P':68" class="idref" href="#P':68"><span class="id" title="binder">P'</span></a> <a id="Q:69" class="idref" href="#Q:69"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:70" class="idref" href="#c:70"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':68"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:70"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:69"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:67"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':68"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:67"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:70"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:69"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')"><span class="show"></span></div>
<div class="proofscript" id="proof2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>, "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>".<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">P'</span> <span class="id" title="var">Q</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">Hpre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Hhoare</span> <span class="id" title="keyword">with</span> (<span class="id" title="var">st</span> := <span class="id" title="var">st</span>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_post" class="idref" href="#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:71" class="idref" href="#P:71"><span class="id" title="binder">P</span></a> <a id="Q:72" class="idref" href="#Q:72"><span class="id" title="binder">Q</span></a> <a id="Q':73" class="idref" href="#Q':73"><span class="id" title="binder">Q'</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:74" class="idref" href="#c:74"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:71"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:74"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q':73"><span class="id" title="variable">Q'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q':73"><span class="id" title="variable">Q'</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#Q:72"><span class="id" title="variable">Q</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:71"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:74"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:72"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')"><span class="show"></span></div>
<div class="proofscript" id="proof3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>, "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>".<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">Q'</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">Hpre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Hhoare</span> <span class="id" title="keyword">with</span> (<span class="id" title="var">st</span> := <span class="id" title="var">st</span>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
For example, we can use the first consequence rule like this:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">X</span> = 1) [<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> 1] <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>}
</span>    Or, formally... 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example1" class="idref" href="#hoare_asgn_example1"><span class="id" title="definition">hoare_asgn_example1</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 1 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> <span class="id" title="keyword">with</span> (<span class="id" title="var">P'</span> := <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> 1<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">_</span>. <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">reflexivity</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We can also use it to prove the example mentioned earlier.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> &lt; 4 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ (<span class="id" title="var">X</span> &lt; 5)[<span class="id" title="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" title="var">X</span> + 1] <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> &lt; 5 <span style='letter-spacing:-.4em;'>}</span>}
</span>   Or, formally ... 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="assn_sub_example2" class="idref" href="#assn_sub_example2"><span class="id" title="definition">assn_sub_example2</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 4<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> <span class="id" title="keyword">with</span> (<span class="id" title="var">P'</span> := <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">H</span>. <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> ×. <span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Finally, here is a combined rule of consequence that allows us to
    vary both the precondition and the postcondition.
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P'</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q'</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" title="var">P'</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Q'</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-----------------------------   (<span class="id" title="var">hoare_consequence</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence" class="idref" href="#hoare_consequence"><span class="id" title="lemma">hoare_consequence</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:75" class="idref" href="#P:75"><span class="id" title="binder">P</span></a> <a id="P':76" class="idref" href="#P':76"><span class="id" title="binder">P'</span></a> <a id="Q:77" class="idref" href="#Q:77"><span class="id" title="binder">Q</span></a> <a id="Q':78" class="idref" href="#Q':78"><span class="id" title="binder">Q'</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:79" class="idref" href="#c:79"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':76"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:79"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q':78"><span class="id" title="variable">Q'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:75"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':76"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q':78"><span class="id" title="variable">Q'</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#Q:77"><span class="id" title="variable">Q</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:75"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:79"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:77"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')"><span class="show"></span></div>
<div class="proofscript" id="proof4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">P'</span> <span class="id" title="var">Q</span> <span class="id" title="var">Q'</span> <span class="id" title="var">c</span> <span class="id" title="var">Htriple</span> <span class="id" title="var">Hpre</span> <span class="id" title="var">Hpost</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> <span class="id" title="keyword">with</span> (<span class="id" title="var">P'</span> := <span class="id" title="var">P'</span>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a> <span class="id" title="keyword">with</span> (<span class="id" title="var">Q'</span> := <span class="id" title="var">Q'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a id="lab69"></a><h2 class="section">Automation</h2>

<div class="paragraph"> </div>

 Many of the proofs we have done so far with Hoare triples can be
    streamlined using the automation techniques that we introduced in
    the <a href="https://softwarefoundations.cis.upenn.edu/lf-current/Auto.html"><span class="inlineref">Auto</span></a> chapter of <i>Logical Foundations</i>.

<div class="paragraph"> </div>

    Recall that the <span class="inlinecode"><span class="id" title="tactic">auto</span></span> tactic can be told to <span class="inlinecode"><span class="id" title="tactic">unfold</span></span> definitions
    as part of its proof search.  Let's give that hint for the
    definitions and coercions we're using: 
</div>
<div class="code">

<span class="id" title="keyword">Hint Unfold</span> <a class="idref" href="Hoare.html#assert_implies"><span class="id" title="definition">assert_implies</span></a> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a> <span class="id" title="definition">t_update</span> : <span class="id" title="var">core</span>.<br/>
<span class="id" title="keyword">Hint Unfold</span> <a class="idref" href="Hoare.html#assert_of_Prop"><span class="id" title="definition">assert_of_Prop</span></a> <a class="idref" href="Hoare.html#Aexp_of_nat"><span class="id" title="definition">Aexp_of_nat</span></a> <a class="idref" href="Hoare.html#Aexp_of_aexp"><span class="id" title="definition">Aexp_of_aexp</span></a> : <span class="id" title="var">core</span>.<br/>
</div>

<div class="doc">
Also recall that <span class="inlinecode"><span class="id" title="tactic">auto</span></span> will search for a proof involving <span class="inlinecode"><span class="id" title="tactic">intros</span></span>
    and <span class="inlinecode"><span class="id" title="tactic">apply</span></span>.  By default, the theorems that it will apply include
    any of the local hypotheses, as well as theorems in a core
    database. 
<div class="paragraph"> </div>

 The proof of <span class="inlinecode"><span class="id" title="var">hoare_consequence_pre</span></span>, repeated below, looks
    like an opportune place for such automation, because all it does
    is <span class="inlinecode"><span class="id" title="tactic">unfold</span></span>, <span class="inlinecode"><span class="id" title="tactic">intros</span></span>, and <span class="inlinecode"><span class="id" title="tactic">apply</span></span>.  It uses <span class="inlinecode"><span class="id" title="tactic">assumption</span></span>, too,
    but that's just application of a hypothesis. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_pre'" class="idref" href="#hoare_consequence_pre'"><span class="id" title="lemma">hoare_consequence_pre'</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:80" class="idref" href="#P:80"><span class="id" title="binder">P</span></a> <a id="P':81" class="idref" href="#P':81"><span class="id" title="binder">P'</span></a> <a id="Q:82" class="idref" href="#Q:82"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:83" class="idref" href="#c:83"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':81"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:83"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:82"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:80"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':81"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:80"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:83"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:82"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>, "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>".<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">P'</span> <span class="id" title="var">Q</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">Hpre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Hhoare</span> <span class="id" title="keyword">with</span> (<span class="id" title="var">st</span> := <span class="id" title="var">st</span>).<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Merely using <span class="inlinecode"><span class="id" title="tactic">auto</span></span>, though, doesn't complete the proof. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_pre''" class="idref" href="#hoare_consequence_pre''"><span class="id" title="lemma">hoare_consequence_pre''</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:84" class="idref" href="#P:84"><span class="id" title="binder">P</span></a> <a id="P':85" class="idref" href="#P':85"><span class="id" title="binder">P'</span></a> <a id="Q:86" class="idref" href="#Q:86"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:87" class="idref" href="#c:87"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':85"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:87"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:86"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:84"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':85"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:84"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:87"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:86"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">auto</span>. <span class="comment">(*&nbsp;no&nbsp;progress&nbsp;*)</span><br/>
<span class="id" title="keyword">Abort</span>.<br/>
</div>

<div class="doc">
The problem is the <span class="inlinecode"><span class="id" title="tactic">apply</span></span> <span class="inlinecode"><span class="id" title="var">Hhoare</span></span> <span class="inlinecode"><span class="id" title="keyword">with</span>...</span> part of the proof.  Coq
    isn't able to figure out how to instantiate <span class="inlinecode"><span class="id" title="var">st</span></span> without some help
    from us.  Recall, though, that there are versions of many tactics
    that will use <i>existential variables</i> to make progress even when
    the regular versions of those tactics would get stuck.

<div class="paragraph"> </div>

    Here, the <span class="inlinecode"><span class="id" title="tactic">eapply</span></span> tactic will introduce an existential variable
    <span class="inlinecode">?<span class="id" title="var">st</span></span> as a placeholder for <span class="inlinecode"><span class="id" title="var">st</span></span>, and <span class="inlinecode"><span class="id" title="var">eassumption</span></span> will
    instantiate <span class="inlinecode">?<span class="id" title="var">st</span></span> with <span class="inlinecode"><span class="id" title="var">st</span></span> when it discovers <span class="inlinecode"><span class="id" title="var">st</span></span> in assumption
    <span class="inlinecode"><span class="id" title="var">Heval</span></span>.  By using <span class="inlinecode"><span class="id" title="tactic">eapply</span></span> we are essentially telling Coq, "Be
    patient: The missing part is going to be filled in later in the
    proof." 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_pre'''" class="idref" href="#hoare_consequence_pre'''"><span class="id" title="lemma">hoare_consequence_pre'''</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:88" class="idref" href="#P:88"><span class="id" title="binder">P</span></a> <a id="P':89" class="idref" href="#P':89"><span class="id" title="binder">P'</span></a> <a id="Q:90" class="idref" href="#Q:90"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:91" class="idref" href="#c:91"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':89"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:91"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:90"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:88"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':89"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:88"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:91"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:90"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>, "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>".<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">P'</span> <span class="id" title="var">Q</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">Hpre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <span class="id" title="var">Hhoare</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">eassumption</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Tactic <span class="inlinecode"><span class="id" title="tactic">eauto</span></span> will use <span class="inlinecode"><span class="id" title="tactic">eapply</span></span> as part of its proof search.
    So, the entire proof can be done in just one line. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_pre''''" class="idref" href="#hoare_consequence_pre''''"><span class="id" title="lemma">hoare_consequence_pre''''</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:92" class="idref" href="#P:92"><span class="id" title="binder">P</span></a> <a id="P':93" class="idref" href="#P':93"><span class="id" title="binder">P'</span></a> <a id="Q:94" class="idref" href="#Q:94"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:95" class="idref" href="#c:95"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':93"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:95"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:94"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:92"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':93"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:92"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:95"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:94"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Of course, it's hard to predict that <span class="inlinecode"><span class="id" title="tactic">eauto</span></span> suffices here
    without having gone through the original proof of
    <span class="inlinecode"><span class="id" title="var">hoare_consequence_pre</span></span> to see the tactics it used. But now that
    we know <span class="inlinecode"><span class="id" title="tactic">eauto</span></span> works, it's a good bet that it will also work for
    <span class="inlinecode"><span class="id" title="var">hoare_consequence_post</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_consequence_post'" class="idref" href="#hoare_consequence_post'"><span class="id" title="lemma">hoare_consequence_post'</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:96" class="idref" href="#P:96"><span class="id" title="binder">P</span></a> <a id="Q:97" class="idref" href="#Q:97"><span class="id" title="binder">Q</span></a> <a id="Q':98" class="idref" href="#Q':98"><span class="id" title="binder">Q'</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:99" class="idref" href="#c:99"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:96"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:99"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q':98"><span class="id" title="variable">Q'</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q':98"><span class="id" title="variable">Q'</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#Q:97"><span class="id" title="variable">Q</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:96"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:99"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:97"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We can also use <span class="inlinecode"><span class="id" title="tactic">eapply</span></span> to streamline a proof,
    <span class="inlinecode"><span class="id" title="var">hoare_asgn_example1</span></span>, that we did earlier as an example of using
    the consequence rule: 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example1'" class="idref" href="#hoare_asgn_example1'"><span class="id" title="definition">hoare_asgn_example1'</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 1 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>. <span class="comment">(*&nbsp;no&nbsp;need&nbsp;to&nbsp;state&nbsp;an&nbsp;assertion&nbsp;*)</span><br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">_</span>. <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">reflexivity</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
The final bullet of that proof also looks like a candidate for
    automation. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example1''" class="idref" href="#hoare_asgn_example1''"><span class="id" title="definition">hoare_asgn_example1''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 1 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Now we have quite a nice proof script: it simply identifies the
    Hoare rules that need to be used and leaves the remaining
    low-level details up to Coq to figure out. 
<div class="paragraph"> </div>

 By now it might be apparent that the <i>entire</i> proof could be
    automated if we added <span class="inlinecode"><span class="id" title="var">hoare_consequence_pre</span></span> and <span class="inlinecode"><span class="id" title="var">hoare_asgn</span></span> to
    the hint database.  We won't do that in this chapter, so that we
    can get a better understanding of when and how the Hoare rules are
    used.  In the next chapter, <a href="Hoare2.html"><span class="inlineref">Hoare2</span></a>, we'll dive deeper into
    automating entire proofs of Hoare triples. 
<div class="paragraph"> </div>

 The other example of using consequence that we did earlier,
    <span class="inlinecode"><span class="id" title="var">hoare_asgn_example2</span></span>, requires a little more work to automate.
    We can streamline the first line with <span class="inlinecode"><span class="id" title="tactic">eapply</span></span>, but we can't just use
    <span class="inlinecode"><span class="id" title="tactic">auto</span></span> for the final bullet, since it needs <span class="inlinecode"><span class="id" title="var">lia</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="assn_sub_example2'" class="idref" href="#assn_sub_example2'"><span class="id" title="definition">assn_sub_example2'</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 4<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">auto</span>. <span class="comment">(*&nbsp;no&nbsp;progress&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">H</span>. <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> ×. <span class="id" title="var">lia</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Let's introduce our own tactic to handle both that bullet and the
    bullet from example 1: 
</div>
<div class="code">

<span class="id" title="keyword">Ltac</span> <span class="id" title="var">assn_auto</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">auto</span>;  <span class="comment">(*&nbsp;as&nbsp;in&nbsp;example&nbsp;1,&nbsp;above&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> (<span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *; <span class="id" title="var">lia</span>). <span class="comment">(*&nbsp;as&nbsp;in&nbsp;example&nbsp;2&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="assn_sub_example2''" class="idref" href="#assn_sub_example2''"><span class="id" title="definition">assn_sub_example2''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 4<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#::assertion_scope:x_'&lt;'_x"><span class="id" title="notation">&lt;</span></a> 5<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">assn_auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example1'''" class="idref" href="#hoare_asgn_example1'''"><span class="id" title="definition">hoare_asgn_example1'''</span></a>:<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 1 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">assn_auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Again, we have quite a nice proof script.  All the low-level
    details of proof about assertions have been taken care of
    automatically. Of course, <span class="inlinecode"><span class="id" title="var">assn_auto</span></span> isn't able to prove
    everything we could possibly want to know about assertions --
    there's no magic here! But it's good enough so far. 
<div class="paragraph"> </div>

<a id="lab70"></a><h4 class="section">Exercise: 2 stars, standard (hoare_asgn_examples_2)</h4>
 Prove these triples.  Try to make your proof scripts as nicely automated
    as those above. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="assn_sub_ex<sub>1</sub>'" class="idref" href="#assn_sub_ex<sub>1</sub>'"><span class="id" title="definition">assn_sub_ex<sub>1</sub>'</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 5 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 2 <span class="id" title="notation">×</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 10 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="assn_sub_ex<sub>2</sub>'" class="idref" href="#assn_sub_ex<sub>2</sub>'"><span class="id" title="definition">assn_sub_ex<sub>2</sub>'</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 0 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 3 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> 3 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 5 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 3<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> 0 <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 5 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab71"></a><h2 class="section">Skip</h2>

<div class="paragraph"> </div>

 Since <span class="inlinecode"><span class="id" title="var">skip</span></span> doesn't change the state, it preserves any
    assertion <span class="inlinecode"><span class="id" title="var">P</span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--------------------  (<span class="id" title="var">hoare_skip</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">skip</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">P</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_skip" class="idref" href="#hoare_skip"><span class="id" title="lemma">hoare_skip</span></a> : <span class="id" title="keyword">∀</span> <a id="P:100" class="idref" href="#P:100"><span class="id" title="binder">P</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:100"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">skip</span> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:100"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')"><span class="show"></span></div>
<div class="proofscript" id="proof5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">H</span> <span class="id" title="var">HP</span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>; <span class="id" title="tactic">subst</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a id="lab72"></a><h2 class="section">Sequencing</h2>

<div class="paragraph"> </div>

 If command <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> takes any state where <span class="inlinecode"><span class="id" title="var">P</span></span> holds to a state where
    <span class="inlinecode"><span class="id" title="var">Q</span></span> holds, and if <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> takes any state where <span class="inlinecode"><span class="id" title="var">Q</span></span> holds to one
    where <span class="inlinecode"><span class="id" title="var">R</span></span> holds, then doing <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> followed by <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> will take any
    state where <span class="inlinecode"><span class="id" title="var">P</span></span> holds to one where <span class="inlinecode"><span class="id" title="var">R</span></span> holds:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub> <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>} c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{ R <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_seq) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub>;c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{ R <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_seq" class="idref" href="#hoare_seq"><span class="id" title="lemma">hoare_seq</span></a> : <span class="id" title="keyword">∀</span> <a id="P:101" class="idref" href="#P:101"><span class="id" title="binder">P</span></a> <a id="Q:102" class="idref" href="#Q:102"><span class="id" title="binder">Q</span></a> <a id="R:103" class="idref" href="#R:103"><span class="id" title="binder">R</span></a> <a id="c<sub>1</sub>:104" class="idref" href="#c<sub>1</sub>:104"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:105" class="idref" href="#c<sub>2</sub>:105"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:102"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:105"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#R:103"><span class="id" title="variable">R</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:101"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:104"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:102"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:101"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:104"><span class="id" title="variable">c<sub>1</sub></span></a><span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#c<sub>2</sub>:105"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#R:103"><span class="id" title="variable">R</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol6" onclick="toggleDisplay('proof6');toggleDisplay('proofcontrol6')"><span class="show"></span></div>
<div class="proofscript" id="proof6" onclick="toggleDisplay('proof6');toggleDisplay('proofcontrol6')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">R</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="var">c<sub>2</sub></span> <span class="id" title="var">H<sub>1</sub></span> <span class="id" title="var">H<sub>2</sub></span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">H<sub>12</sub></span> <span class="id" title="var">Pre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>12</sub></span>; <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Note that, in the formal rule <span class="inlinecode"><span class="id" title="var">hoare_seq</span></span>, the premises are
    given in backwards order (<span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> before <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span>).  This matches the
    natural flow of information in many of the situations where we'll
    use the rule, since the natural way to construct a Hoare-logic
    proof is to begin at the end of the program (with the final
    postcondition) and push postconditions backwards through commands
    until we reach the beginning. 
<div class="paragraph"> </div>

 Here's an example of a program involving sequencing.  Note the use
    of <span class="inlinecode"><span class="id" title="var">hoare_seq</span></span> in conjunction with <span class="inlinecode"><span class="id" title="var">hoare_consequence_pre</span></span> and the
    <span class="inlinecode"><span class="id" title="tactic">eapply</span></span> tactic. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example3" class="idref" href="#hoare_asgn_example3"><span class="id" title="definition">hoare_asgn_example3</span></a> : <span class="id" title="keyword">∀</span> (<a id="a:106" class="idref" href="#a:106"><span class="id" title="binder">a</span></a>:<span class="id" title="inductive">aexp</span>) (<a id="n:107" class="idref" href="#n:107"><span class="id" title="binder">n</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>),<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#a:106"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:107"><span class="id" title="variable">n</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare.html#a:106"><span class="id" title="variable">a</span></a><span class="id" title="notation">;</span><br/>
&nbsp;&nbsp;<span class="id" title="notation">skip</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:107"><span class="id" title="variable">n</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">a</span> <span class="id" title="var">n</span>. <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_seq"><span class="id" title="lemma">hoare_seq</span></a>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;right&nbsp;part&nbsp;of&nbsp;seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_skip"><span class="id" title="lemma">hoare_skip</span></a>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;left&nbsp;part&nbsp;of&nbsp;seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Informally, a nice way of displaying a proof using the sequencing
    rule is as a "decorated program" where the intermediate assertion
    <span class="inlinecode"><span class="id" title="var">Q</span></span> is written between <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span>:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">a</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">a</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}    &lt;--- <span class="id" title="var">decoration</span> <span class="id" title="keyword">for</span> <span class="id" title="var">Q</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">skip</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

<a id="lab73"></a><h4 class="section">Exercise: 2 stars, standard, especially useful (hoare_asgn_example4)</h4>
 Translate this "decorated program" into a formal proof:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ 1 = 1 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 1;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 ∧ 2 = 2 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 1 ∧ <span class="id" title="var">Y</span> = 2 <span style='letter-spacing:-.4em;'>}</span>}
</span>   Note the use of "<span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>" decorations, each marking a use of
   <span class="inlinecode"><span class="id" title="var">hoare_consequence_pre</span></span>.

<div class="paragraph"> </div>

   We've started you off by providing a use of <span class="inlinecode"><span class="id" title="var">hoare_seq</span></span> that
   explicitly identifies <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span> as the intermediate assertion. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="hoare_asgn_example4" class="idref" href="#hoare_asgn_example4"><span class="id" title="definition">hoare_asgn_example4</span></a> :<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 1<span class="id" title="notation">;</span><br/>
&nbsp;&nbsp;<span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1 <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 2 <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_seq"><span class="id" title="lemma">hoare_seq</span></a> <span class="id" title="keyword">with</span> (<span class="id" title="var">Q</span> := (<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 1)%<span class="id" title="var">assertion</span>).<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;The&nbsp;annotation&nbsp;<span class="inlinecode">%<span class="id" title="var">assertion</span></span>&nbsp;is&nbsp;needed&nbsp;here&nbsp;to&nbsp;help&nbsp;Coq&nbsp;parse&nbsp;correctly.&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab74"></a><h4 class="section">Exercise: 3 stars, standard (swap_exercise)</h4>
 Write an Imp program <span class="inlinecode"><span class="id" title="var">c</span></span> that swaps the values of <span class="inlinecode"><span class="id" title="var">X</span></span> and <span class="inlinecode"><span class="id" title="var">Y</span></span> and
    show that it satisfies the following specification:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Y</span> ≤ <span class="id" title="var">X</span><span style='letter-spacing:-.4em;'>}</span>}
</span>    Your proof should not need to use <span class="inlinecode"><span class="id" title="tactic">unfold</span></span> <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span>.  (Hint:
    Remember that the assignment rule works best when it's applied
    "back to front," from the postcondition to the precondition.  So
    your proof will want to start at the end and work back to the
    beginning of your program.)  
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="swap_program" class="idref" href="#swap_program"><span class="id" title="definition">swap_program</span></a> : <span class="id" title="inductive">com</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="swap_exercise" class="idref" href="#swap_exercise"><span class="id" title="lemma">swap_exercise</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#swap_program"><span class="id" title="axiom">swap_program</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">X</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab75"></a><h4 class="section">Exercise: 4 stars, standard (invalid_triple)</h4>
 Show that
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">a</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := 3; <span class="id" title="var">Y</span> := <span class="id" title="var">a</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">Y</span> = <span class="id" title="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>    is not a valid Hoare triple for some choices of <span class="inlinecode"><span class="id" title="var">a</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span>.

<div class="paragraph"> </div>

    Conceptual hint:  invent a particular <span class="inlinecode"><span class="id" title="var">a</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span> for which the triple
    in invalid, then use those to complete the proof.

<div class="paragraph"> </div>

    Technical hint: hypothesis <span class="inlinecode"><span class="id" title="var">H</span></span>, below, begins <span class="inlinecode"><span class="id" title="keyword">∀</span></span> <span class="inlinecode"><span class="id" title="var">a</span></span> <span class="inlinecode"><span class="id" title="var">n</span>,</span> <span class="inlinecode">...</span>.
    You'll want to instantiate that for the particular <span class="inlinecode"><span class="id" title="var">a</span></span> and <span class="inlinecode"><span class="id" title="var">n</span></span>
    you've invented.  You can do that with <span class="inlinecode"><span class="id" title="tactic">assert</span></span> and <span class="inlinecode"><span class="id" title="tactic">apply</span></span>, but
    Coq offers an even easier tactic: <span class="inlinecode"><span class="id" title="tactic">specialize</span></span>.  If you write
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">specialize</span> <span class="id" title="var">H</span> <span class="id" title="keyword">with</span> (<span class="id" title="var">a</span> := <span class="id" title="var">your_a</span>) (<span class="id" title="var">n</span> := <span class="id" title="var">your_n</span>)
</span>    the hypothesis will be instantiated on <span class="inlinecode"><span class="id" title="var">your_a</span></span> and <span class="inlinecode"><span class="id" title="var">your_n</span></span>.
 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="invalid_triple" class="idref" href="#invalid_triple"><span class="id" title="lemma">invalid_triple</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <span class="id" title="keyword">∀</span> (<a id="a:108" class="idref" href="#a:108"><span class="id" title="binder">a</span></a> : <span class="id" title="inductive">aexp</span>) (<a id="n:109" class="idref" href="#n:109"><span class="id" title="binder">n</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>),<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#a:108"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:109"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> 3<span class="id" title="notation">;</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> <a class="idref" href="Hoare.html#a:108"><span class="id" title="variable">a</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:109"><span class="id" title="variable">n</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#hoare_triple"><span class="id" title="definition">hoare_triple</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">H</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab76"></a><h2 class="section">Conditionals</h2>

<div class="paragraph"> </div>

 What sort of rule do we want for reasoning about conditional
    commands?

<div class="paragraph"> </div>

    Certainly, if the same assertion <span class="inlinecode"><span class="id" title="var">Q</span></span> holds after executing
    either of the branches, then it holds after the whole conditional.
    So we might be tempted to write:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} if b then c<sub>1</sub> else c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 However, this is rather weak. For example, using this rule,
   we cannot show
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">if</span> <span class="id" title="var">X</span> = 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">then</span> <span class="id" title="var">Y</span> := 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">else</span> <span class="id" title="var">Y</span> := <span class="id" title="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> ≤ <span class="id" title="var">Y</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>   since the rule tells us nothing about the state in which the
   assignments take place in the "then" and "else" branches. 
<div class="paragraph"> </div>

 Fortunately, we can say something more precise.  In the
    "then" branch, we know that the boolean expression <span class="inlinecode"><span class="id" title="var">b</span></span> evaluates to
    <span class="inlinecode"><span class="id" title="var">true</span></span>, and in the "else" branch, we know it evaluates to <span class="inlinecode"><span class="id" title="var">false</span></span>.
    Making this information available in the premises of the rule gives
    us more information to work with when reasoning about the behavior
    of <span class="inlinecode"><span class="id" title="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" title="var">c<sub>2</sub></span></span> (i.e., the reasons why they establish the
    postcondition <span class="inlinecode"><span class="id" title="var">Q</span></span>). 
<div class="paragraph"> </div>

<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P /\&nbsp;&nbsp;&nbsp;b<span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P /\ ~ b<span style='letter-spacing:-.4em;'>}</span>} c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_if) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} if b then c<sub>1</sub> else c<sub>2</sub> end <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 To interpret this rule formally, we need to do a little work.
    Strictly speaking, the assertion we've written, <span class="inlinecode"><span class="id" title="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" title="var">b</span></span>, is the
    conjunction of an assertion and a boolean expression -- i.e., it
    doesn't typecheck.  To fix this, we need a way of formally
    "lifting" any bexp <span class="inlinecode"><span class="id" title="var">b</span></span> to an assertion.  We'll write <span class="inlinecode"><span class="id" title="var">bassn</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> for
    the assertion "the boolean expression <span class="inlinecode"><span class="id" title="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" title="var">true</span></span> (in
    the given state)." 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="bassn" class="idref" href="#bassn"><span class="id" title="definition">bassn</span></a> <a id="b:110" class="idref" href="#b:110"><span class="id" title="binder">b</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">fun</span> <a id="st:111" class="idref" href="#st:111"><span class="id" title="binder">st</span></a> ⇒ (<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:111"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:110"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Coercion</span> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">:</span></a> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bexp</span></a> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">&gt;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span></a> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">Assertion</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="var">Arguments</span> <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a> /.<br/>
</div>

<div class="doc">
A useful fact about <span class="inlinecode"><span class="id" title="var">bassn</span></span>: 
</div>
<div class="code">

<span class="id" title="keyword">Lemma</span> <a id="bexp_eval_false" class="idref" href="#bexp_eval_false"><span class="id" title="lemma">bexp_eval_false</span></a> : <span class="id" title="keyword">∀</span> <a id="b:112" class="idref" href="#b:112"><span class="id" title="binder">b</span></a> <a id="st:113" class="idref" href="#st:113"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:113"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:112"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">(</span></a>(<a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a> <a class="idref" href="Hoare.html#b:112"><span class="id" title="variable">b</span></a>) <a class="idref" href="Hoare.html#st:113"><span class="id" title="variable">st</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">)</span></a>.<br/>
<div class="togglescript" id="proofcontrol7" onclick="toggleDisplay('proof7');toggleDisplay('proofcontrol7')"><span class="show"></span></div>
<div class="proofscript" id="proof7" onclick="toggleDisplay('proof7');toggleDisplay('proofcontrol7')">
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">congruence</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" title="keyword">Hint Resolve</span> <span class="id" title="var">bexp_eval_false</span> : <span class="id" title="var">core</span>.<br/>
</div>

<div class="doc">
We mentioned the <span class="inlinecode"><span class="id" title="tactic">congruence</span></span> tactic in passing in <a href="https://softwarefoundations.cis.upenn.edu/lf-current/Auto.html"><span class="inlineref">Auto</span></a> when
    building the <span class="inlinecode"><span class="id" title="var">find_rwd</span></span> tactic.  Like <span class="inlinecode"><span class="id" title="var">find_rwd</span></span>, <span class="inlinecode"><span class="id" title="tactic">congruence</span></span> is able to
    automatically find that both <span class="inlinecode"><span class="id" title="var">beval</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">false</span></span> and <span class="inlinecode"><span class="id" title="var">beval</span></span> <span class="inlinecode"><span class="id" title="var">st</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" title="var">true</span></span>
    are being assumed, notice the contradiction, and <span class="inlinecode"><span class="id" title="tactic">discriminate</span></span> to complete
    the proof. 
<div class="paragraph"> </div>

 Now we can formalize the Hoare proof rule for conditionals
    and prove it correct. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_if" class="idref" href="#hoare_if"><span class="id" title="lemma">hoare_if</span></a> : <span class="id" title="keyword">∀</span> <a id="P:114" class="idref" href="#P:114"><span class="id" title="binder">P</span></a> <a id="Q:115" class="idref" href="#Q:115"><span class="id" title="binder">Q</span></a> (<a id="b:116" class="idref" href="#b:116"><span class="id" title="binder">b</span></a>:<span class="id" title="inductive">bexp</span>) <a id="c<sub>1</sub>:117" class="idref" href="#c<sub>1</sub>:117"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:118" class="idref" href="#c<sub>2</sub>:118"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:114"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#b:116"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:117"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:115"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:114"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <a class="idref" href="Hoare.html#b:116"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:118"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:115"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:114"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">if</span> <a class="idref" href="Hoare.html#b:116"><span class="id" title="variable">b</span></a> <span class="id" title="notation">then</span> <a class="idref" href="Hoare.html#c<sub>1</sub>:117"><span class="id" title="variable">c<sub>1</sub></span></a> <span class="id" title="notation">else</span> <a class="idref" href="Hoare.html#c<sub>2</sub>:118"><span class="id" title="variable">c<sub>2</sub></span></a> <span class="id" title="notation">end</span> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:115"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
</div>

<div class="doc">
That is (unwrapping the notations):
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="keyword">Theorem</span> <span class="id" title="var">hoare_if</span> : <span class="id" title="keyword">∀</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">b</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒ <span class="id" title="var">P</span> <span class="id" title="var">st</span> ∧ <span class="id" title="var">bassn</span> <span class="id" title="var">b</span> <span class="id" title="var">st</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c<sub>1</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="keyword">fun</span> <span class="id" title="var">st</span> ⇒ <span class="id" title="var">P</span> <span class="id" title="var">st</span> ∧ ¬(<span class="id" title="var">bassn</span> <span class="id" title="var">b</span> <span class="id" title="var">st</span>)<span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="keyword">if</span> <span class="id" title="var">b</span> <span class="id" title="keyword">then</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="keyword">else</span> <span class="id" title="var">c<sub>2</sub></span> <span class="id" title="keyword">end</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.
</span>
</div>
<div class="code">
<div class="togglescript" id="proofcontrol8" onclick="toggleDisplay('proof8');toggleDisplay('proofcontrol8')"><span class="show"></span></div>
<div class="proofscript" id="proof8" onclick="toggleDisplay('proof8');toggleDisplay('proofcontrol8')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">b</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="var">c<sub>2</sub></span> <span class="id" title="var">HTrue</span> <span class="id" title="var">HFalse</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">HE</span> <span class="id" title="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">HE</span>; <span class="id" title="tactic">subst</span>; <span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a id="lab77"></a><h3 class="section">Example</h3>

<div class="paragraph"> </div>

 Here is a formal proof that the program we used to motivate the
    rule satisfies the specification we gave. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="if_example" class="idref" href="#if_example"><span class="id" title="definition">if_example</span></a> :<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">if</span> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">then</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">else</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_if"><span class="id" title="lemma">hoare_if</span></a>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Then&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto</span>. <span class="comment">(*&nbsp;no&nbsp;progress&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>, <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> [<span class="id" title="var">_</span> <span class="id" title="var">H</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_eq"><span class="id" title="lemma">eqb_eq</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">rewrite</span> <span class="id" title="var">H</span>. <span class="id" title="var">lia</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Else&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
As we did earlier, it would be nice to eliminate all the low-level
    proof script that isn't about the Hoare rules.  Unfortunately, the
    <span class="inlinecode"><span class="id" title="var">assn_auto</span></span> tactic we wrote wasn't quite up to the job.  Looking
    at the proof of <span class="inlinecode"><span class="id" title="var">if_example</span></span>, we can see why.  We had to unfold a
    definition (<span class="inlinecode"><span class="id" title="var">bassn</span></span>) and use a theorem (<span class="inlinecode"><span class="id" title="var">eqb_eq</span></span>) that we didn't
    need in earlier proofs.  So, let's add those into our tactic,
    and clean it up a little in the process. 
</div>
<div class="code">

<span class="id" title="keyword">Ltac</span> <span class="id" title="var">assn_auto'</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>, <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> → <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_eq"><span class="id" title="lemma">eqb_eq</span></a> <span class="id" title="keyword">in</span> *; <span class="comment">(*&nbsp;for&nbsp;equalities&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">auto</span>; <span class="id" title="tactic">try</span> <span class="id" title="var">lia</span>.<br/>
</div>

<div class="doc">
Now the proof is quite streamlined. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="if_example''" class="idref" href="#if_example''"><span class="id" title="definition">if_example''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">if</span> <span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">then</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">else</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_if"><span class="id" title="lemma">hoare_if</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto'</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto'</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We can even shorten it a little bit more. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="if_example'''" class="idref" href="#if_example'''"><span class="id" title="definition">if_example'''</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">if</span> <span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">then</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">else</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> <span class="id" title="definition">Y</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_if"><span class="id" title="lemma">hoare_if</span></a>; <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>; <span class="id" title="tactic">try</span> <span class="id" title="var">assn_auto'</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
For later proofs, it will help to extend <span class="inlinecode"><span class="id" title="var">assn_auto'</span></span> to handle
    inequalities, too. 
</div>
<div class="code">

<span class="id" title="keyword">Ltac</span> <span class="id" title="var">assn_auto''</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> "<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>", <a class="idref" href="Hoare.html#assn_sub"><span class="id" title="definition">assn_sub</span></a>, <span class="id" title="definition">t_update</span>, <a class="idref" href="Hoare.html#bassn"><span class="id" title="definition">bassn</span></a>;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span>; <span class="id" title="tactic">simpl</span> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> → <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.eqb_eq"><span class="id" title="lemma">eqb_eq</span></a> <span class="id" title="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" title="tactic">try</span> <span class="id" title="tactic">rewrite</span> → <a class="idref" href="http://coq.inria.fr/library//Coq.Arith.PeanoNat.html#Nat.leb_le"><span class="id" title="lemma">leb_le</span></a> <span class="id" title="keyword">in</span> *;  <span class="comment">(*&nbsp;for&nbsp;inequalities&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="tactic">auto</span>; <span class="id" title="tactic">try</span> <span class="id" title="var">lia</span>.<br/>
</div>

<div class="doc">
<a id="lab78"></a><h4 class="section">Exercise: 2 stars, standard (if_minus_plus)</h4>
 Prove the theorem below using <span class="inlinecode"><span class="id" title="var">hoare_if</span></span>.  Do not use <span class="inlinecode"><span class="id" title="tactic">unfold</span></span>
    <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="if_minus_plus" class="idref" href="#if_minus_plus"><span class="id" title="lemma">if_minus_plus</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">if</span> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">≤</span> <span class="id" title="definition">Y</span><span class="id" title="notation">)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">then</span> <span class="id" title="definition">Z</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">-</span> <span class="id" title="definition">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="notation">else</span> <span class="id" title="definition">Y</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> <span class="id" title="definition">Z</span><br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Z</span><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab79"></a><h3 class="section">Exercise: One-sided conditionals</h3>

<div class="paragraph"> </div>

 In this exercise we consider extending Imp with "one-sided
    conditionals" of the form <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="keyword">then</span></span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span>. Here <span class="inlinecode"><span class="id" title="var">b</span></span> is a boolean
    expression, and <span class="inlinecode"><span class="id" title="var">c</span></span> is a command. If <span class="inlinecode"><span class="id" title="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" title="var">true</span></span>, then
    command <span class="inlinecode"><span class="id" title="var">c</span></span> is evaluated. If <span class="inlinecode"><span class="id" title="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" title="var">false</span></span>, then <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span> <span class="inlinecode"><span class="id" title="var">b</span></span>
    <span class="inlinecode"><span class="id" title="keyword">then</span></span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span> does nothing.

<div class="paragraph"> </div>

    We recommend that you complete this exercise before attempting the
    ones that follow, as it should help solidify your understanding of
    the material. 
<div class="paragraph"> </div>

 The first step is to extend the syntax of commands and introduce
    the usual notations.  (We've done this for you.  We use a separate
    module to prevent polluting the global name space.) 
</div>
<div class="code">

<span class="id" title="keyword">Module</span> <a id="If<sub>1</sub>" class="idref" href="#If<sub>1</sub>"><span class="id" title="module">If<sub>1</sub></span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Inductive</span> <a id="If<sub>1</sub>.com" class="idref" href="#If<sub>1</sub>.com"><span class="id" title="inductive">com</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CSkip" class="idref" href="#If<sub>1</sub>.CSkip"><span class="id" title="constructor">CSkip</span></a> : <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CAsgn" class="idref" href="#If<sub>1</sub>.CAsgn"><span class="id" title="constructor">CAsgn</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="inductive">aexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CSeq" class="idref" href="#If<sub>1</sub>.CSeq"><span class="id" title="constructor">CSeq</span></a> : <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CIf" class="idref" href="#If<sub>1</sub>.CIf"><span class="id" title="constructor">CIf</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CWhile" class="idref" href="#If<sub>1</sub>.CWhile"><span class="id" title="constructor">CWhile</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.CIf1" class="idref" href="#If<sub>1</sub>.CIf1"><span class="id" title="constructor">CIf1</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:119"><span class="id" title="inductive">com</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'" class="idref" href="#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">&quot;</span></a>'if<sub>1</sub>' x 'then' y 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#If<sub>1</sub>.CIf1"><span class="id" title="constructor">CIf1</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">x</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="If<sub>1</sub>.:com::'skip'" class="idref" href="#If<sub>1</sub>.:com::'skip'"><span class="id" title="notation">&quot;</span></a>'skip'"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#If<sub>1</sub>.CSkip"><span class="id" title="constructor">CSkip</span></a> (<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>" class="idref" href="#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">&quot;</span></a>x := y"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#If<sub>1</sub>.CAsgn"><span class="id" title="constructor">CAsgn</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">x</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 85, <span class="id" title="keyword">no</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="2beb5a0374ebea150aa81fd6eb578944" class="idref" href="#2beb5a0374ebea150aa81fd6eb578944"><span class="id" title="notation">&quot;</span></a>x ; y" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#If<sub>1</sub>.CSeq"><span class="id" title="constructor">CSeq</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'" class="idref" href="#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">&quot;</span></a>'if' x 'then' y 'else' z 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#If<sub>1</sub>.CIf"><span class="id" title="constructor">CIf</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span> <span class="id" title="var">z</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">z</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="If<sub>1</sub>.:com::'while'_x_'do'_x_'end'" class="idref" href="#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">&quot;</span></a>'while' x 'do' y 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#If<sub>1</sub>.CWhile"><span class="id" title="constructor">CWhile</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
</div>

<div class="doc">
<a id="lab80"></a><h4 class="section">Exercise: 2 stars, standard (if1_ceval)</h4>

<div class="paragraph"> </div>

 Add two new evaluation rules to relation <span class="inlinecode"><span class="id" title="var">ceval</span></span>, below, for
    <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span>. Let the rules for <span class="inlinecode"><span class="id" title="keyword">if</span></span> guide you.
</div>
<div class="code">

<span class="id" title="keyword">Reserved Notation</span> &quot;st '=[' c ']=&gt;'' st'"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 40, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">st</span> <span class="id" title="keyword">constr</span>, <span class="id" title="var">st'</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="var">next</span> <span class="id" title="keyword">level</span>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Inductive</span> <a id="If<sub>1</sub>.ceval" class="idref" href="#If<sub>1</sub>.ceval"><span class="id" title="inductive">ceval</span></a> : <a class="idref" href="Hoare.html#If<sub>1</sub>.com"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_Skip" class="idref" href="#If<sub>1</sub>.E_Skip"><span class="id" title="constructor">E_Skip</span></a> : <span class="id" title="keyword">∀</span> <a id="st:123" class="idref" href="#st:123"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:123"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'skip'"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:123"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_Asgn" class="idref" href="#If<sub>1</sub>.E_Asgn"><span class="id" title="constructor">E_Asgn</span></a>  : <span class="id" title="keyword">∀</span> <a id="st:124" class="idref" href="#st:124"><span class="id" title="binder">st</span></a> <a id="a<sub>1</sub>:125" class="idref" href="#a<sub>1</sub>:125"><span class="id" title="binder">a<sub>1</sub></span></a> <a id="n:126" class="idref" href="#n:126"><span class="id" title="binder">n</span></a> <a id="x:127" class="idref" href="#x:127"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:124"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:125"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:126"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:124"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#x:127"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:125"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#x:127"><span class="id" title="variable">x</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#n:126"><span class="id" title="variable">n</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:124"><span class="id" title="variable">st</span></a><a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_Seq" class="idref" href="#If<sub>1</sub>.E_Seq"><span class="id" title="constructor">E_Seq</span></a> : <span class="id" title="keyword">∀</span> <a id="c<sub>1</sub>:128" class="idref" href="#c<sub>1</sub>:128"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:129" class="idref" href="#c<sub>2</sub>:129"><span class="id" title="binder">c<sub>2</sub></span></a> <a id="st:130" class="idref" href="#st:130"><span class="id" title="binder">st</span></a> <a id="st':131" class="idref" href="#st':131"><span class="id" title="binder">st'</span></a> <a id="st'':132" class="idref" href="#st'':132"><span class="id" title="binder">st''</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:130"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:128"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':131"><span class="id" title="variable">st'</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':131"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:129"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':132"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:130"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:128"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#2beb5a0374ebea150aa81fd6eb578944"><span class="id" title="notation">;</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:129"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':132"><span class="id" title="variable">st''</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_IfTrue" class="idref" href="#If<sub>1</sub>.E_IfTrue"><span class="id" title="constructor">E_IfTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:133" class="idref" href="#st:133"><span class="id" title="binder">st</span></a> <a id="st':134" class="idref" href="#st':134"><span class="id" title="binder">st'</span></a> <a id="b:135" class="idref" href="#b:135"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:136" class="idref" href="#c<sub>1</sub>:136"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:137" class="idref" href="#c<sub>2</sub>:137"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:133"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:135"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:133"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:136"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':134"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:133"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:135"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:136"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:137"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':134"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_IfFalse" class="idref" href="#If<sub>1</sub>.E_IfFalse"><span class="id" title="constructor">E_IfFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="st:138" class="idref" href="#st:138"><span class="id" title="binder">st</span></a> <a id="st':139" class="idref" href="#st':139"><span class="id" title="binder">st'</span></a> <a id="b:140" class="idref" href="#b:140"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:141" class="idref" href="#c<sub>1</sub>:141"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:142" class="idref" href="#c<sub>2</sub>:142"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:138"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:140"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:138"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:142"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':139"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:138"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:140"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:141"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:142"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':139"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_WhileFalse" class="idref" href="#If<sub>1</sub>.E_WhileFalse"><span class="id" title="constructor">E_WhileFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="b:143" class="idref" href="#b:143"><span class="id" title="binder">b</span></a> <a id="st:144" class="idref" href="#st:144"><span class="id" title="binder">st</span></a> <a id="c:145" class="idref" href="#c:145"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:144"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:143"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:144"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:143"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:145"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:144"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="If<sub>1</sub>.E_WhileTrue" class="idref" href="#If<sub>1</sub>.E_WhileTrue"><span class="id" title="constructor">E_WhileTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:146" class="idref" href="#st:146"><span class="id" title="binder">st</span></a> <a id="st':147" class="idref" href="#st':147"><span class="id" title="binder">st'</span></a> <a id="st'':148" class="idref" href="#st'':148"><span class="id" title="binder">st''</span></a> <a id="b:149" class="idref" href="#b:149"><span class="id" title="binder">b</span></a> <a id="c:150" class="idref" href="#c:150"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:146"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:149"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:146"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:150"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':147"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':147"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:149"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:150"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':148"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:146"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:149"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:150"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':148"><span class="id" title="variable">st''</span></a><br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<br/>
<span class="id" title="keyword">where</span> <a id="2bd5832dff0b8e46c42539b178101547" class="idref" href="#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">&quot;</span></a>st '=[' c ']=&gt;' st'" := (<a class="idref" href="Hoare.html#ceval:122"><span class="id" title="inductive">ceval</span></a> <span class="id" title="var">c</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Hint Constructors</span> <a class="idref" href="Hoare.html#ceval"><span class="id" title="inductive">ceval</span></a> : <span class="id" title="var">core</span>.<br/>
</div>

<div class="doc">
The following unit tests should be provable simply by <span class="inlinecode"><span class="id" title="tactic">eauto</span></span> if
    you have defined the rules for <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span> correctly. 
</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="If<sub>1</sub>.if1true_test" class="idref" href="#If<sub>1</sub>.if1true_test"><span class="id" title="definition">if1true_test</span></a> :<br/>
&nbsp;&nbsp;<span class="id" title="definition">empty_st</span> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">if<sub>1</sub></span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0 <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">then</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">:=</span></a> 1 <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> 1<a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="If<sub>1</sub>.if1false_test" class="idref" href="#If<sub>1</sub>.if1false_test"><span class="id" title="definition">if1false_test</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> 2<a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">)</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">if<sub>1</sub></span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 0 <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">then</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">:=</span></a> 1 <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">(</span></a><span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> 2<a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

 Now we have to repeat the definition and notation of Hoare triples,
    so that they will use the updated <span class="inlinecode"><span class="id" title="var">com</span></span> type. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="If<sub>1</sub>.hoare_triple" class="idref" href="#If<sub>1</sub>.hoare_triple"><span class="id" title="definition">hoare_triple</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a id="P:151" class="idref" href="#P:151"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="c:152" class="idref" href="#c:152"><span class="id" title="binder">c</span></a> : <a class="idref" href="Hoare.html#If<sub>1</sub>.com"><span class="id" title="inductive">com</span></a>) (<a id="Q:153" class="idref" href="#Q:153"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:154" class="idref" href="#st:154"><span class="id" title="binder">st</span></a> <a id="st':155" class="idref" href="#st':155"><span class="id" title="binder">st'</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:154"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:152"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#2bd5832dff0b8e46c42539b178101547"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':155"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:151"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:154"><span class="id" title="variable">st</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q:153"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st':155"><span class="id" title="variable">st'</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Hint Unfold</span> <a class="idref" href="Hoare.html#If<sub>1</sub>.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> : <span class="id" title="var">core</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>" class="idref" href="#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" := (<a class="idref" href="Hoare.html#If<sub>1</sub>.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="var">P</span> <span class="id" title="var">c</span> <span class="id" title="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" title="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
<a id="lab81"></a><h4 class="section">Exercise: 2 stars, standard (hoare_if<sub>1</sub>)</h4>

<div class="paragraph"> </div>

 Invent a Hoare logic proof rule for <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span>.  State and prove a
    theorem named <span class="inlinecode"><span class="id" title="var">hoare_if<sub>1</sub></span></span> that shows the validity of your rule.
    Use <span class="inlinecode"><span class="id" title="var">hoare_if</span></span> as a guide. Try to invent a rule that is
    <i>complete</i>, meaning it can be used to prove the correctness of as
    many one-sided conditionals as possible.  Also try to keep your
    rule <i>compositional</i>, meaning that any Imp command that appears
    in a premise should syntactically be a part of the command
    in the conclusion.

<div class="paragraph"> </div>

    Hint: if you encounter difficulty getting Coq to parse part of
    your rule as an assertion, try manually indicating that it should
    be in the assertion scope.  For example, if you want <span class="inlinecode"><span class="id" title="var">e</span></span> to be
    parsed as an assertion, write it as <span class="inlinecode">(<span class="id" title="var">e</span>)%<span class="id" title="var">assertion</span></span>. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
For full credit, prove formally <span class="inlinecode"><span class="id" title="var">hoare_if1_good</span></span> that your rule is
    precise enough to show the following valid Hoare triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> + <span class="id" title="var">Y</span> = <span class="id" title="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="var">if<sub>1</sub></span> ~(<span class="id" title="var">Y</span> = 0) <span class="id" title="keyword">then</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> + <span class="id" title="var">Y</span><br/>
&nbsp;&nbsp;<span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = <span class="id" title="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="If<sub>1</sub>.manual_grade_for_hoare_if<sub>1</sub>" class="idref" href="#If<sub>1</sub>.manual_grade_for_hoare_if<sub>1</sub>"><span class="id" title="definition">manual_grade_for_hoare_if<sub>1</sub></span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

 Before the next exercise, we need to restate the Hoare rules of
    consequence (for preconditions) and assignment for the new <span class="inlinecode"><span class="id" title="var">com</span></span>
    type. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="If<sub>1</sub>.hoare_consequence_pre" class="idref" href="#If<sub>1</sub>.hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:156" class="idref" href="#P:156"><span class="id" title="binder">P</span></a> <a id="P':157" class="idref" href="#P':157"><span class="id" title="binder">P'</span></a> <a id="Q:158" class="idref" href="#Q:158"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:159" class="idref" href="#c:159"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':157"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:159"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:158"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:156"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':157"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:156"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:159"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:158"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="If<sub>1</sub>.hoare_asgn" class="idref" href="#If<sub>1</sub>.hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a> : <span class="id" title="keyword">∀</span> <a id="Q:160" class="idref" href="#Q:160"><span class="id" title="binder">Q</span></a> <a id="X:161" class="idref" href="#X:161"><span class="id" title="binder">X</span></a> <a id="a:162" class="idref" href="#a:162"><span class="id" title="binder">a</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:160"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><a class="idref" href="Hoare.html#X:161"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <a class="idref" href="Hoare.html#a:162"><span class="id" title="variable">a</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">(</span><a class="idref" href="Hoare.html#X:161"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a:162"><span class="id" title="variable">a</span></a><span class="id" title="notation">)</span> <a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:160"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">Q</span> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">HQ</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">Heval</span>; <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">auto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab82"></a><h4 class="section">Exercise: 2 stars, standard (hoare_if1_good)</h4>

<div class="paragraph"> </div>

 Prove that your <span class="inlinecode"><span class="id" title="var">if<sub>1</sub></span></span> rule is complete enough for the following
    valid Hoare triple.

<div class="paragraph"> </div>

    Hint: <span class="inlinecode"><span class="id" title="var">assn_auto''</span></span> once more will get you most but not all the way
    to a completely automated proof.  You can finish manually, or
    tweak the tactic further. 
</div>
<div class="code">

<span class="id" title="keyword">Lemma</span> <a id="If<sub>1</sub>.hoare_if1_good" class="idref" href="#If<sub>1</sub>.hoare_if1_good"><span class="id" title="lemma">hoare_if1_good</span></a> :<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#d7f322243320be10cf04dfecd9fa5876"><span class="id" title="notation">+</span></a> <span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">if<sub>1</sub></span></a> <span class="id" title="notation">¬</span><span class="id" title="notation">(</span><span class="id" title="definition">Y</span> <span class="id" title="notation">=</span> 0<span class="id" title="notation">)</span> <a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">then</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#7701c044b287c1aaa4e8c24829bcb1f<sub>5</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> <span class="id" title="definition">Y</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#If<sub>1</sub>.:com::'if<sub>1</sub>'_x_'then'_x_'end'"><span class="id" title="notation">end</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> <span class="id" title="definition">Z</span> <a class="idref" href="Hoare.html#a65ed8b6644a21f0bfd19e8fe0529d<sub>92</sub>"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="code">

<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#If<sub>1</sub>"><span class="id" title="module">If<sub>1</sub></span></a>.<br/>
</div>

<div class="doc">
<a id="lab83"></a><h2 class="section">While Loops</h2>

<div class="paragraph"> </div>

 The Hoare rule for <span class="inlinecode"><span class="id" title="var">while</span></span> loops is based on the idea of an
    <i>invariant</i>: an assertion whose truth is guaranteed before and
    after executing a command.  An assertion <span class="inlinecode"><span class="id" title="var">P</span></span> is an invariant of <span class="inlinecode"><span class="id" title="var">c</span></span> if
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}
</span>    holds.  Note that in the middle of executing <span class="inlinecode"><span class="id" title="var">c</span></span>, the invariant
    might temporarily become false, but by the end of <span class="inlinecode"><span class="id" title="var">c</span></span>, it must be
    restored. 
<div class="paragraph"> </div>

  As a first attempt at a <span class="inlinecode"><span class="id" title="var">while</span></span> rule, we could try:

<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;---------------------------<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span>} <span class="id" title="var">while</span> <span class="id" title="var">b</span> <span class="id" title="tactic">do</span> <span class="id" title="var">c</span> <span class="id" title="keyword">end</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

    That rule is valid: if <span class="inlinecode"><span class="id" title="var">P</span></span> is an invariant of <span class="inlinecode"><span class="id" title="var">c</span></span>, as the premise
    requires, then no matter how many times the loop body executes,
    <span class="inlinecode"><span class="id" title="var">P</span></span> is going to be true when the loop finally finishes.

<div class="paragraph"> </div>

    But the rule also omits two crucial pieces of information.  First,
    the loop terminates when <span class="inlinecode"><span class="id" title="var">b</span></span> becomes false.  So we can strengthen
    the postcondition in the conclusion:

<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;---------------------------------<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span>} <span class="id" title="var">while</span> <span class="id" title="var">b</span> <span class="id" title="tactic">do</span> <span class="id" title="var">c</span> <span class="id" title="keyword">end</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span> ∧ ¬<span class="id" title="var">b</span><span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

    Second, the loop body will be executed only if <span class="inlinecode"><span class="id" title="var">b</span></span> is true.  So we
    can also strengthen the precondition in the premise:

<div class="paragraph"> </div>

<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span> ∧ <span class="id" title="var">b</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--------------------------------- (<span class="id" title="var">hoare_while</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span>} <span class="id" title="var">while</span> <span class="id" title="var">b</span> <span class="id" title="tactic">do</span> <span class="id" title="var">c</span> <span class="id" title="keyword">end</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span> ∧ ¬<span class="id" title="var">b</span><span style='letter-spacing:-.4em;'>}</span>}
</span>
<div class="paragraph"> </div>

 That is the Hoare <span class="inlinecode"><span class="id" title="var">while</span></span> rule.  Note how it combines
    aspects of <span class="inlinecode"><span class="id" title="var">skip</span></span> and conditionals:

<div class="paragraph"> </div>

<ul class="doclist">
<li> If the loop body executes zero times, the rule is like <span class="inlinecode"><span class="id" title="var">skip</span></span> in
      that the precondition survives to become (part of) the
      postcondition.

<div class="paragraph"> </div>


</li>
<li> Like a conditional, we can assume guard <span class="inlinecode"><span class="id" title="var">b</span></span> holds on entry to
      the subcommand.

</li>
</ul>

</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="hoare_while" class="idref" href="#hoare_while"><span class="id" title="lemma">hoare_while</span></a> : <span class="id" title="keyword">∀</span> <a id="P:163" class="idref" href="#P:163"><span class="id" title="binder">P</span></a> (<a id="b:164" class="idref" href="#b:164"><span class="id" title="binder">b</span></a>:<span class="id" title="inductive">bexp</span>) <a id="c:165" class="idref" href="#c:165"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:163"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#b:164"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:165"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:163"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:163"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">while</span> <a class="idref" href="Hoare.html#b:164"><span class="id" title="variable">b</span></a> <span class="id" title="notation">do</span> <a class="idref" href="Hoare.html#c:165"><span class="id" title="variable">c</span></a> <span class="id" title="notation">end</span> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:163"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <a class="idref" href="Hoare.html#b:164"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol9" onclick="toggleDisplay('proof9');toggleDisplay('proofcontrol9')"><span class="show"></span></div>
<div class="proofscript" id="proof9" onclick="toggleDisplay('proof9');toggleDisplay('proofcontrol9')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">b</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Heval</span> <span class="id" title="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;We&nbsp;proceed&nbsp;by&nbsp;induction&nbsp;on&nbsp;<span class="inlinecode"><span class="id" title="var">Heval</span></span>,&nbsp;because,&nbsp;in&nbsp;the&nbsp;"keep&nbsp;looping"&nbsp;case,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;its&nbsp;hypotheses&nbsp;talk&nbsp;about&nbsp;the&nbsp;whole&nbsp;loop&nbsp;instead&nbsp;of&nbsp;just&nbsp;<span class="inlinecode"><span class="id" title="var">c</span></span>.&nbsp;The<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="inlinecode"><span class="id" title="var">remember</span></span>&nbsp;is&nbsp;used&nbsp;to&nbsp;keep&nbsp;the&nbsp;original&nbsp;command&nbsp;in&nbsp;the&nbsp;hypotheses;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;otherwise,&nbsp;it&nbsp;would&nbsp;be&nbsp;lost&nbsp;in&nbsp;the&nbsp;<span class="inlinecode"><span class="id" title="tactic">induction</span></span>.&nbsp;By&nbsp;using&nbsp;<span class="inlinecode"><span class="id" title="tactic">inversion</span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;we&nbsp;clear&nbsp;away&nbsp;all&nbsp;the&nbsp;cases&nbsp;except&nbsp;those&nbsp;involving&nbsp;<span class="inlinecode"><span class="id" title="var">while</span></span>.&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" title="var">remember</span> <span class="id" title="notation">&lt;{</span><span class="id" title="notation">while</span> <span class="id" title="var">b</span> <span class="id" title="notation">do</span> <span class="id" title="var">c</span> <span class="id" title="notation">end</span><span class="id" title="notation">}&gt;</span> <span class="id" title="keyword">as</span> <span class="id" title="var">original_command</span> <span class="id" title="var">eqn</span>:<span class="id" title="var">Horig</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">Heval</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> (<span class="id" title="tactic">inversion</span> <span class="id" title="var">Horig</span>; <span class="id" title="tactic">subst</span>; <span class="id" title="tactic">clear</span> <span class="id" title="var">Horig</span>);<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eauto</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
We call that <span class="inlinecode"><span class="id" title="var">P</span></span> a <i>loop invariant</i> of <span class="inlinecode"><span class="id" title="var">while</span></span> <span class="inlinecode"><span class="id" title="var">b</span></span> <span class="inlinecode"><span class="id" title="tactic">do</span></span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span class="id" title="keyword">end</span></span> if
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span> ∧ <span class="id" title="var">b</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" title="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}
</span>    holds. This means that <span class="inlinecode"><span class="id" title="var">P</span></span> remains true whenever the loop executes.
    If <span class="inlinecode"><span class="id" title="var">P</span></span> contradicts <span class="inlinecode"><span class="id" title="var">b</span></span>, this holds trivially since the precondition
    is false. For instance, <span class="inlinecode"><span class="id" title="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> is a loop invariant of
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">X</span> = 2 <span class="id" title="tactic">do</span> <span class="id" title="var">X</span> := 1 <span class="id" title="keyword">end</span>
</span>    since we will never enter the loop. 
<div class="paragraph"> </div>

 The program
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">while</span> <span class="id" title="var">Y</span> &gt; 10 <span class="id" title="tactic">do</span> <span class="id" title="var">Y</span> := <span class="id" title="var">Y</span> - 1; <span class="id" title="var">Z</span> := <span class="id" title="var">Z</span> + 1 <span class="id" title="keyword">end</span>
</span>    admits an interesting loop invariant:
<br/>
<span class="inlinecode">&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> = <span class="id" title="var">Y</span> + <span class="id" title="var">Z</span>
</span>    Note that this doesn't contradict the loop guard but neither
    is it an invariant of <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1;</span> <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">:=</span> <span class="inlinecode"><span class="id" title="var">Z</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> -- if X = 5,
    Y = 0 and Z = 5, running the command will set Y + Z to 6. The
    loop guard <span class="inlinecode"><span class="id" title="var">Y</span></span> <span class="inlinecode">&gt;</span> <span class="inlinecode">10</span> guarantees that this will not be the case.
    We will see many such loop invariants in the following chapter.

</div>
<div class="code">

<span class="id" title="keyword">Example</span> <a id="while_example" class="idref" href="#while_example"><span class="id" title="definition">while_example</span></a> :<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#154e85acf24eb57aa8f8a0156c0ba632"><span class="id" title="notation">≤</span></a> 3<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<span class="id" title="notation">while</span> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">≤</span> 2<span class="id" title="notation">)</span> <span class="id" title="notation">do</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <span class="id" title="notation">:=</span> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;<span class="id" title="notation">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#5ad5c240a08c2b567f422c2e12577e<sub>27</sub>"><span class="id" title="notation">=</span></a> 3<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol10" onclick="toggleDisplay('proof10');toggleDisplay('proofcontrol10')"><span class="show"></span></div>
<div class="proofscript" id="proof10" onclick="toggleDisplay('proof10');toggleDisplay('proofcontrol10')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="var">assn_auto''</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="var">assn_auto''</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
If the loop never terminates, any postcondition will work. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="always_loop_hoare" class="idref" href="#always_loop_hoare"><span class="id" title="lemma">always_loop_hoare</span></a> : <span class="id" title="keyword">∀</span> <a id="Q:166" class="idref" href="#Q:166"><span class="id" title="binder">Q</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <span class="id" title="notation">while</span> <span class="id" title="notation">true</span> <span class="id" title="notation">do</span> <span class="id" title="notation">skip</span> <span class="id" title="notation">end</span> <a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:166"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#a18cbce9fe584a9130c3f34d4f14555f"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<div class="togglescript" id="proofcontrol11" onclick="toggleDisplay('proof11');toggleDisplay('proofcontrol11')"><span class="show"></span></div>
<div class="proofscript" id="proof11" onclick="toggleDisplay('proof11');toggleDisplay('proofcontrol11')">
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">Q</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_while"><span class="id" title="lemma">hoare_while</span></a>. <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#hoare_post_true"><span class="id" title="axiom">hoare_post_true</span></a>. <span class="id" title="tactic">auto</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">simpl</span>. <span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> [<span class="id" title="var">Hinv</span> <span class="id" title="var">Hguard</span>]. <span class="id" title="tactic">congruence</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Of course, this result is not surprising if we remember that
    the definition of <span class="inlinecode"><span class="id" title="var">hoare_triple</span></span> asserts that the postcondition
    must hold <i>only</i> when the command terminates.  If the command
    doesn't terminate, we can prove anything we like about the
    post-condition.

<div class="paragraph"> </div>

    Hoare rules that specify what happens <i>if</i> commands terminate,
    without proving that they do, are said to describe a logic of
    <i>partial</i> correctness.  It is also possible to give Hoare rules
    for <i>total</i> correctness, which additionally specifies that
    commands must terminate. Total correctness is out of the scope of
    this textbook. 
</div>

<div class="doc">
<a id="lab84"></a><h3 class="section">Exercise: <span class="inlinecode"><span class="id" title="var">REPEAT</span></span></h3>

<div class="paragraph"> </div>

<a id="lab85"></a><h4 class="section">Exercise: 4 stars, advanced (hoare_repeat)</h4>
 In this exercise, we'll add a new command to our language of
    commands: <span class="inlinecode"><span class="id" title="var">REPEAT</span></span> c <span class="inlinecode"><span class="id" title="tactic">until</span></span> b <span class="inlinecode"><span class="id" title="keyword">end</span></span>. You will write the
    evaluation rule for <span class="inlinecode"><span class="id" title="var">REPEAT</span></span> and add a new Hoare rule to the
    language for programs involving it.  (You may recall that the
    evaluation rule is given in an example in the <a href="https://softwarefoundations.cis.upenn.edu/lf-current/Auto.html"><span class="inlineref">Auto</span></a> chapter.
    Try to figure it out yourself here rather than peeking.) 
</div>
<div class="code">

<span class="id" title="keyword">Module</span> <a id="RepeatExercise" class="idref" href="#RepeatExercise"><span class="id" title="module">RepeatExercise</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Inductive</span> <a id="RepeatExercise.com" class="idref" href="#RepeatExercise.com"><span class="id" title="inductive">com</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CSkip" class="idref" href="#RepeatExercise.CSkip"><span class="id" title="constructor">CSkip</span></a> : <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CAsgn" class="idref" href="#RepeatExercise.CAsgn"><span class="id" title="constructor">CAsgn</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="inductive">aexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CSeq" class="idref" href="#RepeatExercise.CSeq"><span class="id" title="constructor">CSeq</span></a> : <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CIf" class="idref" href="#RepeatExercise.CIf"><span class="id" title="constructor">CIf</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CWhile" class="idref" href="#RepeatExercise.CWhile"><span class="id" title="constructor">CWhile</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.CRepeat" class="idref" href="#RepeatExercise.CRepeat"><span class="id" title="constructor">CRepeat</span></a> : <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:167"><span class="id" title="inductive">com</span></a>.<br/>
</div>

<div class="doc">
<span class="inlinecode"><span class="id" title="var">REPEAT</span></span> behaves like <span class="inlinecode"><span class="id" title="var">while</span></span>, except that the loop guard is
    checked <i>after</i> each execution of the body, with the loop
    repeating as long as the guard stays <i>false</i>.  Because of this,
    the body will always execute at least once. 
</div>
<div class="code">

<span class="id" title="keyword">Notation</span> <a id="RepeatExercise.:com::'repeat'_x_'until'_x_'end'" class="idref" href="#RepeatExercise.:com::'repeat'_x_'until'_x_'end'"><span class="id" title="notation">&quot;</span></a>'repeat' e<sub>1</sub> 'until' b<sub>2</sub> 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.CRepeat"><span class="id" title="constructor">CRepeat</span></a> <span class="id" title="var">e<sub>1</sub></span> <span class="id" title="var">b<sub>2</sub></span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">e<sub>1</sub></span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">b<sub>2</sub></span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="RepeatExercise.:com::'skip'" class="idref" href="#RepeatExercise.:com::'skip'"><span class="id" title="notation">&quot;</span></a>'skip'"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#RepeatExercise.CSkip"><span class="id" title="constructor">CSkip</span></a> (<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="36cabe8d358913ff5c5a00e869f6acb5" class="idref" href="#36cabe8d358913ff5c5a00e869f6acb5"><span class="id" title="notation">&quot;</span></a>x := y"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.CAsgn"><span class="id" title="constructor">CAsgn</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">x</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 85, <span class="id" title="keyword">no</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="47032bba53eedb10a43a5da19a84838f" class="idref" href="#47032bba53eedb10a43a5da19a84838f"><span class="id" title="notation">&quot;</span></a>x ; y" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.CSeq"><span class="id" title="constructor">CSeq</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'" class="idref" href="#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">&quot;</span></a>'if' x 'then' y 'else' z 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.CIf"><span class="id" title="constructor">CIf</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span> <span class="id" title="var">z</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">z</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="RepeatExercise.:com::'while'_x_'do'_x_'end'" class="idref" href="#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">&quot;</span></a>'while' x 'do' y 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.CWhile"><span class="id" title="constructor">CWhile</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
</div>

<div class="doc">
Add new rules for <span class="inlinecode"><span class="id" title="var">REPEAT</span></span> to <span class="inlinecode"><span class="id" title="var">ceval</span></span> below.  You can use the rules
    for <span class="inlinecode"><span class="id" title="var">while</span></span> as a guide, but remember that the body of a <span class="inlinecode"><span class="id" title="var">REPEAT</span></span>
    should always execute at least once, and that the loop ends when
    the guard becomes true. 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="RepeatExercise.ceval" class="idref" href="#RepeatExercise.ceval"><span class="id" title="inductive">ceval</span></a> : <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#RepeatExercise.com"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_Skip" class="idref" href="#RepeatExercise.E_Skip"><span class="id" title="constructor">E_Skip</span></a> : <span class="id" title="keyword">∀</span> <a id="st:171" class="idref" href="#st:171"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:171"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'skip'"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:171"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_Asgn" class="idref" href="#RepeatExercise.E_Asgn"><span class="id" title="constructor">E_Asgn</span></a>  : <span class="id" title="keyword">∀</span> <a id="st:172" class="idref" href="#st:172"><span class="id" title="binder">st</span></a> <a id="a<sub>1</sub>:173" class="idref" href="#a<sub>1</sub>:173"><span class="id" title="binder">a<sub>1</sub></span></a> <a id="n:174" class="idref" href="#n:174"><span class="id" title="binder">n</span></a> <a id="x:175" class="idref" href="#x:175"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:172"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:173"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:174"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:172"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#x:175"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#36cabe8d358913ff5c5a00e869f6acb5"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:173"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#x:175"><span class="id" title="variable">x</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#n:174"><span class="id" title="variable">n</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:172"><span class="id" title="variable">st</span></a><a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_Seq" class="idref" href="#RepeatExercise.E_Seq"><span class="id" title="constructor">E_Seq</span></a> : <span class="id" title="keyword">∀</span> <a id="c<sub>1</sub>:176" class="idref" href="#c<sub>1</sub>:176"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:177" class="idref" href="#c<sub>2</sub>:177"><span class="id" title="binder">c<sub>2</sub></span></a> <a id="st:178" class="idref" href="#st:178"><span class="id" title="binder">st</span></a> <a id="st':179" class="idref" href="#st':179"><span class="id" title="binder">st'</span></a> <a id="st'':180" class="idref" href="#st'':180"><span class="id" title="binder">st''</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:178"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:176"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':179"><span class="id" title="variable">st'</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':179"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:177"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':180"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:178"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:176"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#47032bba53eedb10a43a5da19a84838f"><span class="id" title="notation">;</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:177"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':180"><span class="id" title="variable">st''</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_IfTrue" class="idref" href="#RepeatExercise.E_IfTrue"><span class="id" title="constructor">E_IfTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:181" class="idref" href="#st:181"><span class="id" title="binder">st</span></a> <a id="st':182" class="idref" href="#st':182"><span class="id" title="binder">st'</span></a> <a id="b:183" class="idref" href="#b:183"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:184" class="idref" href="#c<sub>1</sub>:184"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:185" class="idref" href="#c<sub>2</sub>:185"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:181"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:183"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:181"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:184"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':182"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:181"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:183"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:184"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:185"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':182"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_IfFalse" class="idref" href="#RepeatExercise.E_IfFalse"><span class="id" title="constructor">E_IfFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="st:186" class="idref" href="#st:186"><span class="id" title="binder">st</span></a> <a id="st':187" class="idref" href="#st':187"><span class="id" title="binder">st'</span></a> <a id="b:188" class="idref" href="#b:188"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:189" class="idref" href="#c<sub>1</sub>:189"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:190" class="idref" href="#c<sub>2</sub>:190"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:186"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:188"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:186"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:190"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':187"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:186"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:188"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:189"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:190"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':187"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_WhileFalse" class="idref" href="#RepeatExercise.E_WhileFalse"><span class="id" title="constructor">E_WhileFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="b:191" class="idref" href="#b:191"><span class="id" title="binder">b</span></a> <a id="st:192" class="idref" href="#st:192"><span class="id" title="binder">st</span></a> <a id="c:193" class="idref" href="#c:193"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:192"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:191"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:192"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:191"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:193"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:192"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="RepeatExercise.E_WhileTrue" class="idref" href="#RepeatExercise.E_WhileTrue"><span class="id" title="constructor">E_WhileTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:194" class="idref" href="#st:194"><span class="id" title="binder">st</span></a> <a id="st':195" class="idref" href="#st':195"><span class="id" title="binder">st'</span></a> <a id="st'':196" class="idref" href="#st'':196"><span class="id" title="binder">st''</span></a> <a id="b:197" class="idref" href="#b:197"><span class="id" title="binder">b</span></a> <a id="c:198" class="idref" href="#c:198"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:194"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:197"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:194"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:198"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':195"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':195"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:197"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:198"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':196"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:194"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:197"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:198"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#RepeatExercise.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':196"><span class="id" title="variable">st''</span></a><br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<br/>
<span class="id" title="keyword">where</span> <a id="6fac257586d84b458187327c836ad986" class="idref" href="#6fac257586d84b458187327c836ad986"><span class="id" title="notation">&quot;</span></a>st '=[' c ']=&gt;' st'" := (<a class="idref" href="Hoare.html#ceval:170"><span class="id" title="inductive">ceval</span></a> <span class="id" title="var">st</span> <span class="id" title="var">c</span> <span class="id" title="var">st'</span>).<br/>
</div>

<div class="doc">
A couple of definitions from above, copied here so they use the
    new <span class="inlinecode"><span class="id" title="var">ceval</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="RepeatExercise.hoare_triple" class="idref" href="#RepeatExercise.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> (<a id="P:199" class="idref" href="#P:199"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="c:200" class="idref" href="#c:200"><span class="id" title="binder">c</span></a> : <a class="idref" href="Hoare.html#RepeatExercise.com"><span class="id" title="inductive">com</span></a>) (<a id="Q:201" class="idref" href="#Q:201"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:202" class="idref" href="#st:202"><span class="id" title="binder">st</span></a> <a id="st':203" class="idref" href="#st':203"><span class="id" title="binder">st'</span></a>, <a class="idref" href="Hoare.html#st:202"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:200"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':203"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#P:199"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:202"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#Q:201"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st':203"><span class="id" title="variable">st'</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="a3c0f595dd7cb1c96c488172230fa934" class="idref" href="#a3c0f595dd7cb1c96c488172230fa934"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<a class="idref" href="Hoare.html#RepeatExercise.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="var">P</span> <span class="id" title="var">c</span> <span class="id" title="var">Q</span>) (<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
</div>

<div class="doc">
To make sure you've got the evaluation rules for <span class="inlinecode"><span class="id" title="tactic">repeat</span></span> right,
    prove that <span class="inlinecode"><span class="id" title="var">ex1_repeat</span></span> evaluates correctly. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="RepeatExercise.ex1_repeat" class="idref" href="#RepeatExercise.ex1_repeat"><span class="id" title="definition">ex1_repeat</span></a> :=<br/>
&nbsp;&nbsp;<span class="id" title="notation">&lt;{</span> <a class="idref" href="Hoare.html#RepeatExercise.:com::'repeat'_x_'until'_x_'end'"><span class="id" title="notation">repeat</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#36cabe8d358913ff5c5a00e869f6acb5"><span class="id" title="notation">:=</span></a> 1<a class="idref" href="Hoare.html#47032bba53eedb10a43a5da19a84838f"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">Y</span> <a class="idref" href="Hoare.html#36cabe8d358913ff5c5a00e869f6acb5"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">Y</span> <span class="id" title="notation">+</span> 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#RepeatExercise.:com::'repeat'_x_'until'_x_'end'"><span class="id" title="notation">until</span></a> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 1<span class="id" title="notation">)</span> <a class="idref" href="Hoare.html#RepeatExercise.:com::'repeat'_x_'until'_x_'end'"><span class="id" title="notation">end</span></a> <span class="id" title="notation">}&gt;</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="RepeatExercise.ex1_repeat_works" class="idref" href="#RepeatExercise.ex1_repeat_works"><span class="id" title="lemma">ex1_repeat_works</span></a> :<br/>
&nbsp;&nbsp;<span class="id" title="definition">empty_st</span> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#RepeatExercise.ex1_repeat"><span class="id" title="definition">ex1_repeat</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">(</span></a><span class="id" title="definition">Y</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> 1 <span class="id" title="notation">;</span> <span class="id" title="definition">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> 1<a class="idref" href="Hoare.html#6fac257586d84b458187327c836ad986"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
</div>

<div class="doc">
Now state and prove a theorem, <span class="inlinecode"><span class="id" title="var">hoare_repeat</span></span>, that expresses an
    appropriate proof rule for <span class="inlinecode"><span class="id" title="tactic">repeat</span></span> commands.  Use <span class="inlinecode"><span class="id" title="var">hoare_while</span></span>
    as a model, and try to make your rule as precise as possible. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
For full credit, make sure (informally) that your rule can be used
    to prove the following valid Hoare triple:
<br/>
<span class="inlinecode">&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> &gt; 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" title="tactic">repeat</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">Y</span> := <span class="id" title="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">X</span> := <span class="id" title="var">X</span> - 1<br/>
&nbsp;&nbsp;<span class="id" title="tactic">until</span> <span class="id" title="var">X</span> = 0 <span class="id" title="keyword">end</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" title="var">X</span> = 0 ∧ <span class="id" title="var">Y</span> &gt; 0 <span style='letter-spacing:-.4em;'>}</span>}
</span>
</div>
<div class="code">

<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#RepeatExercise"><span class="id" title="module">RepeatExercise</span></a>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" title="keyword">Definition</span> <a id="manual_grade_for_hoare_repeat" class="idref" href="#manual_grade_for_hoare_repeat"><span class="id" title="definition">manual_grade_for_hoare_repeat</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#option"><span class="id" title="inductive">option</span></a> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#11c698c8685bb8ab1cf725545c085ac<sub>4</sub>"><span class="id" title="notation">×</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) := <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#None"><span class="id" title="constructor">None</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>


<div class="doc">
<a id="lab86"></a><h1 class="section">Summary</h1>

<div class="paragraph"> </div>

 So far, we've introduced Hoare Logic as a tool for reasoning about
    Imp programs.  The rules of Hoare Logic are:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{Q [X <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> a]<span style='letter-spacing:-.4em;'>}</span>} X:=a <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_skip) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} skip <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub> <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>} c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{ R <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_seq) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub>;c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{ R <span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P /\&nbsp;&nbsp;&nbsp;b<span style='letter-spacing:-.4em;'>}</span>} c<sub>1</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P /\ ~ b<span style='letter-spacing:-.4em;'>}</span>} c<sub>2</sub> <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_if) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} if b then c<sub>1</sub> else c<sub>2</sub> end <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P /\ b<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_while) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} while b do c end <span style='letter-spacing:-.4em;'>{</span>{P /\ ~ b<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q'<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> P'</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">Q' <span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> Q</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>} c <span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>    In the next chapter, we'll see how these rules are used to prove
    that more interesting programs satisfy interesting specifications of
    their behavior. 
</div>

<div class="doc">
<a id="lab87"></a><h1 class="section">Additional Exercises</h1>

<div class="paragraph"> </div>

<a id="lab88"></a><h2 class="section">Havoc</h2>

<div class="paragraph"> </div>

 In this exercise, we will derive proof rules for a <span class="inlinecode"><span class="id" title="var">HAVOC</span></span>
    command, which is similar to the nondeterministic <span class="inlinecode"><span class="id" title="var">any</span></span> expression
    from the the <a href="Imp.html"><span class="inlineref">Imp</span></a> chapter.

<div class="paragraph"> </div>

    First, we enclose this work in a separate module, and recall the
    syntax and big-step semantics of Himp commands. 
</div>
<div class="code">

<span class="id" title="keyword">Module</span> <a id="Himp" class="idref" href="#Himp"><span class="id" title="module">Himp</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Inductive</span> <a id="Himp.com" class="idref" href="#Himp.com"><span class="id" title="inductive">com</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="Himp.CSkip" class="idref" href="#Himp.CSkip"><span class="id" title="constructor">CSkip</span></a> : <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.CAsgn" class="idref" href="#Himp.CAsgn"><span class="id" title="constructor">CAsgn</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="inductive">aexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.CSeq" class="idref" href="#Himp.CSeq"><span class="id" title="constructor">CSeq</span></a> : <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.CIf" class="idref" href="#Himp.CIf"><span class="id" title="constructor">CIf</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.CWhile" class="idref" href="#Himp.CWhile"><span class="id" title="constructor">CWhile</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.CHavoc" class="idref" href="#Himp.CHavoc"><span class="id" title="constructor">CHavoc</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:204"><span class="id" title="inductive">com</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="Himp.:com::'havoc'_x" class="idref" href="#Himp.:com::'havoc'_x"><span class="id" title="notation">&quot;</span></a>'havoc' l" := (<a class="idref" href="Hoare.html#Himp.CHavoc"><span class="id" title="constructor">CHavoc</span></a> <span class="id" title="var">l</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 60, <span class="id" title="var">l</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="Himp.:com::'skip'" class="idref" href="#Himp.:com::'skip'"><span class="id" title="notation">&quot;</span></a>'skip'"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#Himp.CSkip"><span class="id" title="constructor">CSkip</span></a> (<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="8520c4c68851dd55d33b324c83d1c4f<sub>5</sub>" class="idref" href="#8520c4c68851dd55d33b324c83d1c4f<sub>5</sub>"><span class="id" title="notation">&quot;</span></a>x := y"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#Himp.CAsgn"><span class="id" title="constructor">CAsgn</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">x</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 85, <span class="id" title="keyword">no</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="77cb1189aa0f77e096b5d4774eb2d829" class="idref" href="#77cb1189aa0f77e096b5d4774eb2d829"><span class="id" title="notation">&quot;</span></a>x ; y" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#Himp.CSeq"><span class="id" title="constructor">CSeq</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="Himp.:com::'if'_x_'then'_x_'else'_x_'end'" class="idref" href="#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">&quot;</span></a>'if' x 'then' y 'else' z 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#Himp.CIf"><span class="id" title="constructor">CIf</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span> <span class="id" title="var">z</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">z</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="Himp.:com::'while'_x_'do'_x_'end'" class="idref" href="#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">&quot;</span></a>'while' x 'do' y 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#Himp.CWhile"><span class="id" title="constructor">CWhile</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Inductive</span> <a id="Himp.ceval" class="idref" href="#Himp.ceval"><span class="id" title="inductive">ceval</span></a> : <a class="idref" href="Hoare.html#Himp.com"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <a id="Himp.E_Skip" class="idref" href="#Himp.E_Skip"><span class="id" title="constructor">E_Skip</span></a> : <span class="id" title="keyword">∀</span> <a id="st:208" class="idref" href="#st:208"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:208"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'skip'"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:208"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_Asgn" class="idref" href="#Himp.E_Asgn"><span class="id" title="constructor">E_Asgn</span></a>  : <span class="id" title="keyword">∀</span> <a id="st:209" class="idref" href="#st:209"><span class="id" title="binder">st</span></a> <a id="a<sub>1</sub>:210" class="idref" href="#a<sub>1</sub>:210"><span class="id" title="binder">a<sub>1</sub></span></a> <a id="n:211" class="idref" href="#n:211"><span class="id" title="binder">n</span></a> <a id="x:212" class="idref" href="#x:212"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:209"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:210"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:211"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:209"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#x:212"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#8520c4c68851dd55d33b324c83d1c4f<sub>5</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:210"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#x:212"><span class="id" title="variable">x</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#n:211"><span class="id" title="variable">n</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:209"><span class="id" title="variable">st</span></a><a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_Seq" class="idref" href="#Himp.E_Seq"><span class="id" title="constructor">E_Seq</span></a> : <span class="id" title="keyword">∀</span> <a id="c<sub>1</sub>:213" class="idref" href="#c<sub>1</sub>:213"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:214" class="idref" href="#c<sub>2</sub>:214"><span class="id" title="binder">c<sub>2</sub></span></a> <a id="st:215" class="idref" href="#st:215"><span class="id" title="binder">st</span></a> <a id="st':216" class="idref" href="#st':216"><span class="id" title="binder">st'</span></a> <a id="st'':217" class="idref" href="#st'':217"><span class="id" title="binder">st''</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:215"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:213"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':216"><span class="id" title="variable">st'</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':216"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:214"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':217"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:215"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:213"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#77cb1189aa0f77e096b5d4774eb2d829"><span class="id" title="notation">;</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:214"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':217"><span class="id" title="variable">st''</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_IfTrue" class="idref" href="#Himp.E_IfTrue"><span class="id" title="constructor">E_IfTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:218" class="idref" href="#st:218"><span class="id" title="binder">st</span></a> <a id="st':219" class="idref" href="#st':219"><span class="id" title="binder">st'</span></a> <a id="b:220" class="idref" href="#b:220"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:221" class="idref" href="#c<sub>1</sub>:221"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:222" class="idref" href="#c<sub>2</sub>:222"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:218"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:220"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:218"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:221"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':219"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:218"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:220"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:221"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:222"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':219"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_IfFalse" class="idref" href="#Himp.E_IfFalse"><span class="id" title="constructor">E_IfFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="st:223" class="idref" href="#st:223"><span class="id" title="binder">st</span></a> <a id="st':224" class="idref" href="#st':224"><span class="id" title="binder">st'</span></a> <a id="b:225" class="idref" href="#b:225"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:226" class="idref" href="#c<sub>1</sub>:226"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:227" class="idref" href="#c<sub>2</sub>:227"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:223"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:225"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:223"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:227"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':224"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:223"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:225"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:226"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:227"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#Himp.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':224"><span class="id" title="variable">st'</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_WhileFalse" class="idref" href="#Himp.E_WhileFalse"><span class="id" title="constructor">E_WhileFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="b:228" class="idref" href="#b:228"><span class="id" title="binder">b</span></a> <a id="st:229" class="idref" href="#st:229"><span class="id" title="binder">st</span></a> <a id="c:230" class="idref" href="#c:230"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:229"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:228"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:229"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:228"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:230"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st:229"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_WhileTrue" class="idref" href="#Himp.E_WhileTrue"><span class="id" title="constructor">E_WhileTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:231" class="idref" href="#st:231"><span class="id" title="binder">st</span></a> <a id="st':232" class="idref" href="#st':232"><span class="id" title="binder">st'</span></a> <a id="st'':233" class="idref" href="#st'':233"><span class="id" title="binder">st''</span></a> <a id="b:234" class="idref" href="#b:234"><span class="id" title="binder">b</span></a> <a id="c:235" class="idref" href="#c:235"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:231"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:234"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:231"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:235"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':232"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':232"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:234"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:235"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':233"><span class="id" title="variable">st''</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:231"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:234"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:235"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#Himp.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st'':233"><span class="id" title="variable">st''</span></a><br/>
&nbsp;&nbsp;| <a id="Himp.E_Havoc" class="idref" href="#Himp.E_Havoc"><span class="id" title="constructor">E_Havoc</span></a> : <span class="id" title="keyword">∀</span> <a id="st:236" class="idref" href="#st:236"><span class="id" title="binder">st</span></a> <a id="X:237" class="idref" href="#X:237"><span class="id" title="binder">X</span></a> <a id="n:238" class="idref" href="#n:238"><span class="id" title="binder">n</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:236"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#Himp.:com::'havoc'_x"><span class="id" title="notation">havoc</span></a> <a class="idref" href="Hoare.html#X:237"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#X:237"><span class="id" title="variable">X</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#n:238"><span class="id" title="variable">n</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:236"><span class="id" title="variable">st</span></a><a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">)</span></a><br/>
<br/>
<span class="id" title="keyword">where</span> <a id="e8def6e1c7a66877a96e361d5569b34e" class="idref" href="#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">&quot;</span></a>st '=[' c ']=&gt;' st'" := (<a class="idref" href="Hoare.html#ceval:207"><span class="id" title="inductive">ceval</span></a> <span class="id" title="var">c</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span>).<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Hint Constructors</span> <a class="idref" href="Hoare.html#ceval"><span class="id" title="inductive">ceval</span></a> : <span class="id" title="var">core</span>.<br/>
</div>

<div class="doc">
The definition of Hoare triples is exactly as before. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="Himp.hoare_triple" class="idref" href="#Himp.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> (<a id="P:239" class="idref" href="#P:239"><span class="id" title="binder">P</span></a>:<a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="c:240" class="idref" href="#c:240"><span class="id" title="binder">c</span></a>:<a class="idref" href="Hoare.html#Himp.com"><span class="id" title="inductive">com</span></a>) (<a id="Q:241" class="idref" href="#Q:241"><span class="id" title="binder">Q</span></a>:<a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:242" class="idref" href="#st:242"><span class="id" title="binder">st</span></a> <a id="st':243" class="idref" href="#st':243"><span class="id" title="binder">st'</span></a>, <a class="idref" href="Hoare.html#st:242"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:240"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#e8def6e1c7a66877a96e361d5569b34e"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#st':243"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#P:239"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:242"><span class="id" title="variable">st</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#Q:241"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st':243"><span class="id" title="variable">st'</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Hint Unfold</span> <a class="idref" href="Hoare.html#Himp.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> : <span class="id" title="var">core</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="fa43534376ba696f5288a24534018f6c" class="idref" href="#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" := (<a class="idref" href="Hoare.html#Himp.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="var">P</span> <span class="id" title="var">c</span> <span class="id" title="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" title="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
And the precondition consequence rule is exactly as before. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="Himp.hoare_consequence_pre" class="idref" href="#Himp.hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:244" class="idref" href="#P:244"><span class="id" title="binder">P</span></a> <a id="P':245" class="idref" href="#P':245"><span class="id" title="binder">P'</span></a> <a id="Q:246" class="idref" href="#Q:246"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:247" class="idref" href="#c:247"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':245"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:247"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:246"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:244"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':245"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:244"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:247"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:246"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>. <span class="id" title="tactic">eauto</span>. <span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a id="lab89"></a><h4 class="section">Exercise: 3 stars, standard (hoare_havoc)</h4>

<div class="paragraph"> </div>

 Complete the Hoare rule for <span class="inlinecode"><span class="id" title="var">HAVOC</span></span> commands below by defining
    <span class="inlinecode"><span class="id" title="var">havoc_pre</span></span>, and prove that the resulting rule is correct. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="Himp.havoc_pre" class="idref" href="#Himp.havoc_pre"><span class="id" title="definition">havoc_pre</span></a> (<a id="X:248" class="idref" href="#X:248"><span class="id" title="binder">X</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>) (<a id="Q:249" class="idref" href="#Q:249"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="st:250" class="idref" href="#st:250"><span class="id" title="binder">st</span></a> : <span class="id" title="definition">total_map</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a>) : <span class="id" title="keyword">Prop</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="Himp.hoare_havoc" class="idref" href="#Himp.hoare_havoc"><span class="id" title="lemma">hoare_havoc</span></a> : <span class="id" title="keyword">∀</span> (<a id="Q:251" class="idref" href="#Q:251"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="X:252" class="idref" href="#X:252"><span class="id" title="binder">X</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>),<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#Himp.havoc_pre"><span class="id" title="axiom">havoc_pre</span></a> <a class="idref" href="Hoare.html#X:252"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#Q:251"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#Himp.:com::'havoc'_x"><span class="id" title="notation">havoc</span></a> <a class="idref" href="Hoare.html#X:252"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#Q:251"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="doc"> 
<div class="paragraph"> </div>

<a id="lab90"></a><h4 class="section">Exercise: 3 stars, standard (havoc_post)</h4>

<div class="paragraph"> </div>

 Complete the following proof without changing any of the provided
    commands. If you find that it can't be completed, your definition of
    <span class="inlinecode"><span class="id" title="var">havoc_pre</span></span> is probably too strong. Find a way to relax it so that
    <span class="inlinecode"><span class="id" title="var">havoc_post</span></span> can be proved.

<div class="paragraph"> </div>

    Hint: the <span class="inlinecode"><span class="id" title="var">assn_auto</span></span> tactics we've built won't help you here.
    You need to proceed manually. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="Himp.havoc_post" class="idref" href="#Himp.havoc_post"><span class="id" title="lemma">havoc_post</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:253" class="idref" href="#P:253"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="X:254" class="idref" href="#X:254"><span class="id" title="binder">X</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a>),<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:253"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#Himp.:com::'havoc'_x"><span class="id" title="notation">havoc</span></a> <a class="idref" href="Hoare.html#X:254"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <span class="id" title="keyword">fun</span> <a id="st:255" class="idref" href="#st:255"><span class="id" title="binder">st</span></a> ⇒ <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">(</span></a><a id="n:256" class="idref" href="#n:256"><span class="id" title="binder">n</span></a>:<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Datatypes.html#nat"><span class="id" title="inductive">nat</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">),</span></a> <a class="idref" href="Hoare.html#P:253"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><a class="idref" href="Hoare.html#X:254"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <a class="idref" href="Hoare.html#n:256"><span class="id" title="variable">n</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">st</span></a> <a class="idref" href="Hoare.html#fa43534376ba696f5288a24534018f6c"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">X</span>. <span class="id" title="tactic">eapply</span> <a class="idref" href="Hoare.html#Himp.hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#Himp.hoare_havoc"><span class="id" title="axiom">hoare_havoc</span></a>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="code">

<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#Himp"><span class="id" title="module">Himp</span></a>.<br/>
</div>

<div class="doc">
<a id="lab91"></a><h2 class="section">Assert and Assume</h2>

<div class="paragraph"> </div>

<a id="lab92"></a><h4 class="section">Exercise: 4 stars, standard, optional (assert_vs_assume)</h4>

</div>
<div class="code">

<span class="id" title="keyword">Module</span> <a id="HoareAssertAssume" class="idref" href="#HoareAssertAssume"><span class="id" title="module">HoareAssertAssume</span></a>.<br/>
</div>

<div class="doc">
In this exercise, we will extend IMP with two commands,
     <span class="inlinecode"><span class="id" title="tactic">assert</span></span> and <span class="inlinecode"><span class="id" title="var">ASSUME</span></span>. Both commands are ways
     to indicate that a certain statement should hold any time this part
     of the program is reached. However they differ as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> If an <span class="inlinecode"><span class="id" title="tactic">assert</span></span> statement fails, it causes the program to go into
      an error state and exit.

<div class="paragraph"> </div>


</li>
<li> If an <span class="inlinecode"><span class="id" title="var">ASSUME</span></span> statement fails, the program fails to evaluate
      at all. In other words, the program gets stuck and has no
      final state.

</li>
</ul>

<div class="paragraph"> </div>

    The new set of commands is: 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="HoareAssertAssume.com" class="idref" href="#HoareAssertAssume.com"><span class="id" title="inductive">com</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CSkip" class="idref" href="#HoareAssertAssume.CSkip"><span class="id" title="constructor">CSkip</span></a> : <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CAsgn" class="idref" href="#HoareAssertAssume.CAsgn"><span class="id" title="constructor">CAsgn</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Strings.String.html#string"><span class="id" title="inductive">string</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="inductive">aexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CSeq" class="idref" href="#HoareAssertAssume.CSeq"><span class="id" title="constructor">CSeq</span></a> : <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CIf" class="idref" href="#HoareAssertAssume.CIf"><span class="id" title="constructor">CIf</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CWhile" class="idref" href="#HoareAssertAssume.CWhile"><span class="id" title="constructor">CWhile</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CAssert" class="idref" href="#HoareAssertAssume.CAssert"><span class="id" title="constructor">CAssert</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.CAssume" class="idref" href="#HoareAssertAssume.CAssume"><span class="id" title="constructor">CAssume</span></a> : <span class="id" title="inductive">bexp</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#com:257"><span class="id" title="inductive">com</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="HoareAssertAssume.:com::'assert'_x" class="idref" href="#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">&quot;</span></a>'assert' l" := (<a class="idref" href="Hoare.html#HoareAssertAssume.CAssert"><span class="id" title="constructor">CAssert</span></a> <span class="id" title="var">l</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 8, <span class="id" title="var">l</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="HoareAssertAssume.:com::'assume'_x" class="idref" href="#HoareAssertAssume.:com::'assume'_x"><span class="id" title="notation">&quot;</span></a>'assume' l" := (<a class="idref" href="Hoare.html#HoareAssertAssume.CAssume"><span class="id" title="constructor">CAssume</span></a> <span class="id" title="var">l</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 8, <span class="id" title="var">l</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="HoareAssertAssume.:com::'skip'" class="idref" href="#HoareAssertAssume.:com::'skip'"><span class="id" title="notation">&quot;</span></a>'skip'"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#HoareAssertAssume.CSkip"><span class="id" title="constructor">CSkip</span></a> (<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0).<br/>
<span class="id" title="keyword">Notation</span> <a id="60a9f580307c9b3c5e2be1b3b9a8ef<sub>14</sub>" class="idref" href="#60a9f580307c9b3c5e2be1b3b9a8ef<sub>14</sub>"><span class="id" title="notation">&quot;</span></a>x := y"  :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#HoareAssertAssume.CAsgn"><span class="id" title="constructor">CAsgn</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0, <span class="id" title="var">x</span> <span class="id" title="keyword">constr</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 0,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 85, <span class="id" title="keyword">no</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="20723b1e1e241a343867017aa438ad3d" class="idref" href="#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">&quot;</span></a>x ; y" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#HoareAssertAssume.CSeq"><span class="id" title="constructor">CSeq</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="tactic">right</span> <span class="id" title="keyword">associativity</span>).<br/>
<span class="id" title="keyword">Notation</span> <a id="HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'" class="idref" href="#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">&quot;</span></a>'if' x 'then' y 'else' z 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#HoareAssertAssume.CIf"><span class="id" title="constructor">CIf</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span> <span class="id" title="var">z</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">z</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
<span class="id" title="keyword">Notation</span> <a id="HoareAssertAssume.:com::'while'_x_'do'_x_'end'" class="idref" href="#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">&quot;</span></a>'while' x 'do' y 'end'" :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a class="idref" href="Hoare.html#HoareAssertAssume.CWhile"><span class="id" title="constructor">CWhile</span></a> <span class="id" title="var">x</span> <span class="id" title="var">y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" title="keyword">in</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 89, <span class="id" title="var">x</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99, <span class="id" title="var">y</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99).<br/>
</div>

<div class="doc">
To define the behavior of <span class="inlinecode"><span class="id" title="tactic">assert</span></span> and <span class="inlinecode"><span class="id" title="var">ASSUME</span></span>, we need to add
    notation for an error, which indicates that an assertion has
    failed. We modify the <span class="inlinecode"><span class="id" title="var">ceval</span></span> relation, therefore, so that
    it relates a start state to either an end state or to <span class="inlinecode"><span class="id" title="var">error</span></span>.
    The <span class="inlinecode"><span class="id" title="var">result</span></span> type indicates the end value of a program,
    either a state or an error: 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="HoareAssertAssume.result" class="idref" href="#HoareAssertAssume.result"><span class="id" title="inductive">result</span></a> : <span class="id" title="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.RNormal" class="idref" href="#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> : <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#result:259"><span class="id" title="inductive">result</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.RError" class="idref" href="#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a> : <a class="idref" href="Hoare.html#result:259"><span class="id" title="inductive">result</span></a>.<br/>
</div>

<div class="doc">
Now we are ready to give you the ceval relation for the new language. 
</div>
<div class="code">

<span class="id" title="keyword">Inductive</span> <a id="HoareAssertAssume.ceval" class="idref" href="#HoareAssertAssume.ceval"><span class="id" title="inductive">ceval</span></a> : <a class="idref" href="Hoare.html#HoareAssertAssume.com"><span class="id" title="inductive">com</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="definition">state</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.result"><span class="id" title="inductive">result</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;Old&nbsp;rules,&nbsp;several&nbsp;modified&nbsp;*)</span><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_Skip" class="idref" href="#HoareAssertAssume.E_Skip"><span class="id" title="constructor">E_Skip</span></a> : <span class="id" title="keyword">∀</span> <a id="st:263" class="idref" href="#st:263"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:263"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'skip'"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st:263"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_Asgn" class="idref" href="#HoareAssertAssume.E_Asgn"><span class="id" title="constructor">E_Asgn</span></a>  : <span class="id" title="keyword">∀</span> <a id="st:264" class="idref" href="#st:264"><span class="id" title="binder">st</span></a> <a id="a<sub>1</sub>:265" class="idref" href="#a<sub>1</sub>:265"><span class="id" title="binder">a<sub>1</sub></span></a> <a id="n:266" class="idref" href="#n:266"><span class="id" title="binder">n</span></a> <a id="x:267" class="idref" href="#x:267"><span class="id" title="binder">x</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">aeval</span> <a class="idref" href="Hoare.html#st:264"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:265"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#n:266"><span class="id" title="variable">n</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:264"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#x:267"><span class="id" title="variable">x</span></a> <a class="idref" href="Hoare.html#60a9f580307c9b3c5e2be1b3b9a8ef<sub>14</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a<sub>1</sub>:265"><span class="id" title="variable">a<sub>1</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> (<a class="idref" href="Hoare.html#x:267"><span class="id" title="variable">x</span></a> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <a class="idref" href="Hoare.html#n:266"><span class="id" title="variable">n</span></a> <span class="id" title="notation">;</span> <a class="idref" href="Hoare.html#st:264"><span class="id" title="variable">st</span></a>)<br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_SeqNormal" class="idref" href="#HoareAssertAssume.E_SeqNormal"><span class="id" title="constructor">E_SeqNormal</span></a> : <span class="id" title="keyword">∀</span> <a id="c<sub>1</sub>:268" class="idref" href="#c<sub>1</sub>:268"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:269" class="idref" href="#c<sub>2</sub>:269"><span class="id" title="binder">c<sub>2</sub></span></a> <a id="st:270" class="idref" href="#st:270"><span class="id" title="binder">st</span></a> <a id="st':271" class="idref" href="#st':271"><span class="id" title="binder">st'</span></a> <a id="r:272" class="idref" href="#r:272"><span class="id" title="binder">r</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:270"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:268"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st':271"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':271"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:269"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:272"><span class="id" title="variable">r</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:270"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:268"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">;</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:269"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:272"><span class="id" title="variable">r</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_SeqError" class="idref" href="#HoareAssertAssume.E_SeqError"><span class="id" title="constructor">E_SeqError</span></a> : <span class="id" title="keyword">∀</span> <a id="c<sub>1</sub>:273" class="idref" href="#c<sub>1</sub>:273"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:274" class="idref" href="#c<sub>2</sub>:274"><span class="id" title="binder">c<sub>2</sub></span></a> <a id="st:275" class="idref" href="#st:275"><span class="id" title="binder">st</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:275"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:273"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:275"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:273"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">;</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:274"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_IfTrue" class="idref" href="#HoareAssertAssume.E_IfTrue"><span class="id" title="constructor">E_IfTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:276" class="idref" href="#st:276"><span class="id" title="binder">st</span></a> <a id="r:277" class="idref" href="#r:277"><span class="id" title="binder">r</span></a> <a id="b:278" class="idref" href="#b:278"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:279" class="idref" href="#c<sub>1</sub>:279"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:280" class="idref" href="#c<sub>2</sub>:280"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:276"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:278"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:276"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:279"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:277"><span class="id" title="variable">r</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:276"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:278"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:279"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:280"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:277"><span class="id" title="variable">r</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_IfFalse" class="idref" href="#HoareAssertAssume.E_IfFalse"><span class="id" title="constructor">E_IfFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="st:281" class="idref" href="#st:281"><span class="id" title="binder">st</span></a> <a id="r:282" class="idref" href="#r:282"><span class="id" title="binder">r</span></a> <a id="b:283" class="idref" href="#b:283"><span class="id" title="binder">b</span></a> <a id="c<sub>1</sub>:284" class="idref" href="#c<sub>1</sub>:284"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:285" class="idref" href="#c<sub>2</sub>:285"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:281"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:283"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:281"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:285"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:282"><span class="id" title="variable">r</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:281"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:283"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:284"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:285"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:282"><span class="id" title="variable">r</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_WhileFalse" class="idref" href="#HoareAssertAssume.E_WhileFalse"><span class="id" title="constructor">E_WhileFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="b:286" class="idref" href="#b:286"><span class="id" title="binder">b</span></a> <a id="st:287" class="idref" href="#st:287"><span class="id" title="binder">st</span></a> <a id="c:288" class="idref" href="#c:288"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:287"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:286"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:287"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:286"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:288"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st:287"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_WhileTrueNormal" class="idref" href="#HoareAssertAssume.E_WhileTrueNormal"><span class="id" title="constructor">E_WhileTrueNormal</span></a> : <span class="id" title="keyword">∀</span> <a id="st:289" class="idref" href="#st:289"><span class="id" title="binder">st</span></a> <a id="st':290" class="idref" href="#st':290"><span class="id" title="binder">st'</span></a> <a id="r:291" class="idref" href="#r:291"><span class="id" title="binder">r</span></a> <a id="b:292" class="idref" href="#b:292"><span class="id" title="binder">b</span></a> <a id="c:293" class="idref" href="#c:293"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:289"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:292"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:289"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:293"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st':290"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st':290"><span class="id" title="variable">st'</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:292"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:293"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:291"><span class="id" title="variable">r</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:289"><span class="id" title="variable">st</span></a>  <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:292"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:293"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:291"><span class="id" title="variable">r</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_WhileTrueError" class="idref" href="#HoareAssertAssume.E_WhileTrueError"><span class="id" title="constructor">E_WhileTrueError</span></a> : <span class="id" title="keyword">∀</span> <a id="st:294" class="idref" href="#st:294"><span class="id" title="binder">st</span></a> <a id="b:295" class="idref" href="#b:295"><span class="id" title="binder">b</span></a> <a id="c:296" class="idref" href="#c:296"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:294"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:295"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:294"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:296"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:294"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:295"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:296"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;Rules&nbsp;for&nbsp;Assert&nbsp;and&nbsp;Assume&nbsp;*)</span><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_AssertTrue" class="idref" href="#HoareAssertAssume.E_AssertTrue"><span class="id" title="constructor">E_AssertTrue</span></a> : <span class="id" title="keyword">∀</span> <a id="st:297" class="idref" href="#st:297"><span class="id" title="binder">st</span></a> <a id="b:298" class="idref" href="#b:298"><span class="id" title="binder">b</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:297"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:298"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:297"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">assert</span></a> <a class="idref" href="Hoare.html#b:298"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st:297"><span class="id" title="variable">st</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_AssertFalse" class="idref" href="#HoareAssertAssume.E_AssertFalse"><span class="id" title="constructor">E_AssertFalse</span></a> : <span class="id" title="keyword">∀</span> <a id="st:299" class="idref" href="#st:299"><span class="id" title="binder">st</span></a> <a id="b:300" class="idref" href="#b:300"><span class="id" title="binder">b</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:299"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:300"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">false</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:299"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">assert</span></a> <a class="idref" href="Hoare.html#b:300"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RError"><span class="id" title="constructor">RError</span></a><br/>
&nbsp;&nbsp;| <a id="HoareAssertAssume.E_Assume" class="idref" href="#HoareAssertAssume.E_Assume"><span class="id" title="constructor">E_Assume</span></a> : <span class="id" title="keyword">∀</span> <a id="st:301" class="idref" href="#st:301"><span class="id" title="binder">st</span></a> <a id="b:302" class="idref" href="#b:302"><span class="id" title="binder">b</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="definition">beval</span> <a class="idref" href="Hoare.html#st:301"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#b:302"><span class="id" title="variable">b</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <span class="id" title="notation">true</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:301"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assume'_x"><span class="id" title="notation">assume</span></a> <a class="idref" href="Hoare.html#b:302"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st:301"><span class="id" title="variable">st</span></a><br/>
<br/>
<span class="id" title="keyword">where</span> <a id="4b975d013783f0069676486bfb27e44a" class="idref" href="#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">&quot;</span></a>st '=[' c ']=&gt;' r" := (<a class="idref" href="Hoare.html#ceval:262"><span class="id" title="inductive">ceval</span></a> <span class="id" title="var">c</span> <span class="id" title="var">st</span> <span class="id" title="var">r</span>).<br/>
</div>

<div class="doc">
We redefine hoare triples: Now, <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" title="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" title="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span> means that,
    whenever <span class="inlinecode"><span class="id" title="var">c</span></span> is started in a state satisfying <span class="inlinecode"><span class="id" title="var">P</span></span>, and terminates
    with result <span class="inlinecode"><span class="id" title="var">r</span></span>, then <span class="inlinecode"><span class="id" title="var">r</span></span> is not an error and the state of <span class="inlinecode"><span class="id" title="var">r</span></span>
    satisfies <span class="inlinecode"><span class="id" title="var">Q</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Definition</span> <a id="HoareAssertAssume.hoare_triple" class="idref" href="#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<a id="P:303" class="idref" href="#P:303"><span class="id" title="binder">P</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) (<a id="c:304" class="idref" href="#c:304"><span class="id" title="binder">c</span></a> : <a class="idref" href="Hoare.html#HoareAssertAssume.com"><span class="id" title="inductive">com</span></a>) (<a id="Q:305" class="idref" href="#Q:305"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) : <span class="id" title="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" title="keyword">∀</span> <a id="st:306" class="idref" href="#st:306"><span class="id" title="binder">st</span></a> <a id="r:307" class="idref" href="#r:307"><span class="id" title="binder">r</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#st:306"><span class="id" title="variable">st</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">=[</span></a> <a class="idref" href="Hoare.html#c:304"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#4b975d013783f0069676486bfb27e44a"><span class="id" title="notation">]=&gt;</span></a> <a class="idref" href="Hoare.html#r:307"><span class="id" title="variable">r</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="Hoare.html#P:303"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#st:306"><span class="id" title="variable">st</span></a>  <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a id="st':308" class="idref" href="#st':308"><span class="id" title="binder">st'</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">,</span></a> <a class="idref" href="Hoare.html#r:307"><span class="id" title="variable">r</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st':308"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#Q:305"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#st':308"><span class="id" title="variable">st'</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Notation</span> <a id="ab05c802c6c420830babdf44d877dfd1" class="idref" href="#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation">&quot;</span></a><span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<a class="idref" href="Hoare.html#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="var">P</span> <span class="id" title="var">c</span> <span class="id" title="var">Q</span>) (<span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 90, <span class="id" title="var">c</span> <span class="id" title="var">custom</span> <span class="id" title="var">com</span> <span class="id" title="tactic">at</span> <span class="id" title="keyword">level</span> 99)<br/>
&nbsp;&nbsp;: <span class="id" title="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
To test your understanding of this modification, give an example
    precondition and postcondition that are satisfied by the <span class="inlinecode"><span class="id" title="var">ASSUME</span></span>
    statement but not by the <span class="inlinecode"><span class="id" title="tactic">assert</span></span> statement.  Then prove that any
    triple for <span class="inlinecode"><span class="id" title="tactic">assert</span></span> also works for <span class="inlinecode"><span class="id" title="var">ASSUME</span></span>. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.assert_assume_differ" class="idref" href="#HoareAssertAssume.assert_assume_differ"><span class="id" title="lemma">assert_assume_differ</span></a> : <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">(</span></a><a id="P:309" class="idref" href="#P:309"><span class="id" title="binder">P</span></a>:<a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="b:310" class="idref" href="#b:310"><span class="id" title="binder">b</span></a> (<a id="Q:311" class="idref" href="#Q:311"><span class="id" title="binder">Q</span></a>:<a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">),</span></a><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:309"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assume'_x"><span class="id" title="notation">assume</span></a> <a class="idref" href="Hoare.html#b:310"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:311"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">¬</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:309"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">assert</span></a> <a class="idref" href="Hoare.html#b:310"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:311"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#63a68285c81db8f9bc456233bb9ed181"><span class="id" title="notation">)</span></a>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.assert_implies_assume" class="idref" href="#HoareAssertAssume.assert_implies_assume"><span class="id" title="lemma">assert_implies_assume</span></a> : <span class="id" title="keyword">∀</span> <a id="P:312" class="idref" href="#P:312"><span class="id" title="binder">P</span></a> <a id="b:313" class="idref" href="#b:313"><span class="id" title="binder">b</span></a> <a id="Q:314" class="idref" href="#Q:314"><span class="id" title="binder">Q</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:312"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">assert</span></a> <a class="idref" href="Hoare.html#b:313"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:314"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">(</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:312"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assume'_x"><span class="id" title="notation">assume</span></a> <a class="idref" href="Hoare.html#b:313"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:314"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">)</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/>
</div>

<div class="doc">
Your task is now to state Hoare rules for <span class="inlinecode"><span class="id" title="tactic">assert</span></span> and <span class="inlinecode"><span class="id" title="var">assume</span></span>,
    and use them to prove a simple program correct.  Name your hoare
    rule theorems <span class="inlinecode"><span class="id" title="var">hoare_assert</span></span> and <span class="inlinecode"><span class="id" title="var">hoare_assume</span></span>.

<div class="paragraph"> </div>

    For your benefit, we provide proofs for the old hoare rules
    adapted to the new semantics. 
</div>
<div class="code">

<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_asgn" class="idref" href="#HoareAssertAssume.hoare_asgn"><span class="id" title="lemma">hoare_asgn</span></a> : <span class="id" title="keyword">∀</span> <a id="Q:315" class="idref" href="#Q:315"><span class="id" title="binder">Q</span></a> <a id="X:316" class="idref" href="#X:316"><span class="id" title="binder">X</span></a> <a id="a:317" class="idref" href="#a:317"><span class="id" title="binder">a</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:315"><span class="id" title="variable">Q</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">[</span></a><a class="idref" href="Hoare.html#X:316"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span></a> <a class="idref" href="Hoare.html#a:317"><span class="id" title="variable">a</span></a><a class="idref" href="Hoare.html#bf32e07a6a6f21756fecc93ac97674bb"><span class="id" title="notation">]</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#X:316"><span class="id" title="variable">X</span></a> <a class="idref" href="Hoare.html#60a9f580307c9b3c5e2be1b3b9a8ef<sub>14</sub>"><span class="id" title="notation">:=</span></a> <a class="idref" href="Hoare.html#a:317"><span class="id" title="variable">a</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:315"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">Q</span> <span class="id" title="var">X</span> <span class="id" title="var">a</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">HE</span> <span class="id" title="var">HQ</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">HE</span>. <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">∃</span> (<span class="id" title="var">X</span> <span class="id" title="notation">!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span></span> <span class="id" title="definition">aeval</span> <span class="id" title="var">st</span> <span class="id" title="var">a</span> <span class="id" title="notation">;</span> <span class="id" title="var">st</span>). <span class="id" title="tactic">split</span>; <span class="id" title="tactic">try</span> <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_consequence_pre" class="idref" href="#HoareAssertAssume.hoare_consequence_pre"><span class="id" title="lemma">hoare_consequence_pre</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:318" class="idref" href="#P:318"><span class="id" title="binder">P</span></a> <a id="P':319" class="idref" href="#P':319"><span class="id" title="binder">P'</span></a> <a id="Q:320" class="idref" href="#Q:320"><span class="id" title="binder">Q</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:321" class="idref" href="#c:321"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P':319"><span class="id" title="variable">P'</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:321"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:320"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#P:318"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#P':319"><span class="id" title="variable">P'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:318"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:321"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:320"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">P'</span> <span class="id" title="var">Q</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">Hc</span> <span class="id" title="var">HP</span>. <span class="id" title="tactic">apply</span> (<span class="id" title="var">Hhoare</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span>).<br/>
&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_consequence_post" class="idref" href="#HoareAssertAssume.hoare_consequence_post"><span class="id" title="lemma">hoare_consequence_post</span></a> : <span class="id" title="keyword">∀</span> (<a id="P:322" class="idref" href="#P:322"><span class="id" title="binder">P</span></a> <a id="Q:323" class="idref" href="#Q:323"><span class="id" title="binder">Q</span></a> <a id="Q':324" class="idref" href="#Q':324"><span class="id" title="binder">Q'</span></a> : <a class="idref" href="Hoare.html#Assertion"><span class="id" title="definition">Assertion</span></a>) <a id="c:325" class="idref" href="#c:325"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:322"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:325"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q':324"><span class="id" title="variable">Q'</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#Q':324"><span class="id" title="variable">Q'</span></a> <a class="idref" href="Hoare.html#::hoare_spec_scope:x_'-&gt;&gt;'_x"><span class="id" title="notation"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span></a> <a class="idref" href="Hoare.html#Q:323"><span class="id" title="variable">Q</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:322"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:325"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:323"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">Q'</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">st</span> <span class="id" title="var">r</span> <span class="id" title="var">Hc</span> <span class="id" title="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">Hhoare</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">assert</span> (<a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">∃</span></a> <a id="st':327" class="idref" href="#st':327"><span class="id" title="binder">st'</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#a883bdd010993579f99d60b3775bcf54"><span class="id" title="notation">,</span></a> <span class="id" title="var">r</span> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#6cd0f7b28b6092304087c7049437bb1a"><span class="id" title="notation">=</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.RNormal"><span class="id" title="constructor">RNormal</span></a> <a class="idref" href="Hoare.html#st':326"><span class="id" title="variable">st'</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#ba2b0e492d2b4675a0acf3ea92aabadd"><span class="id" title="notation">∧</span></a> <span class="id" title="var">Q'</span> <a class="idref" href="Hoare.html#st':326"><span class="id" title="variable">st'</span></a>).<br/>
&nbsp;&nbsp;{ <span class="id" title="tactic">apply</span> (<span class="id" title="var">Hhoare</span> <span class="id" title="var">st</span>); <span class="id" title="tactic">assumption</span>. }<br/>
&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">H</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">st'</span> [<span class="id" title="var">Hr</span> <span class="id" title="var">HQ'</span>] ].<br/>
&nbsp;&nbsp;<span class="id" title="tactic">∃</span> <span class="id" title="var">st'</span>. <span class="id" title="tactic">split</span>; <span class="id" title="tactic">try</span> <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Himp</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_seq" class="idref" href="#HoareAssertAssume.hoare_seq"><span class="id" title="lemma">hoare_seq</span></a> : <span class="id" title="keyword">∀</span> <a id="P:328" class="idref" href="#P:328"><span class="id" title="binder">P</span></a> <a id="Q:329" class="idref" href="#Q:329"><span class="id" title="binder">Q</span></a> <a id="R:330" class="idref" href="#R:330"><span class="id" title="binder">R</span></a> <a id="c<sub>1</sub>:331" class="idref" href="#c<sub>1</sub>:331"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:332" class="idref" href="#c<sub>2</sub>:332"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:329"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:332"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#R:330"><span class="id" title="variable">R</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:328"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:331"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:329"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:328"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:331"><span class="id" title="variable">c<sub>1</sub></span></a><a class="idref" href="Hoare.html#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">;</span></a><a class="idref" href="Hoare.html#c<sub>2</sub>:332"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#R:330"><span class="id" title="variable">R</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">R</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="var">c<sub>2</sub></span> <span class="id" title="var">H<sub>1</sub></span> <span class="id" title="var">H<sub>2</sub></span> <span class="id" title="var">st</span> <span class="id" title="var">r</span> <span class="id" title="var">H<sub>12</sub></span> <span class="id" title="var">Pre</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">H<sub>12</sub></span>; <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;- <span class="id" title="tactic">eapply</span> <span class="id" title="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>6</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>2</sub></span> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>3</sub></span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>3</sub></span> <span class="id" title="keyword">in</span> <span class="id" title="var">Pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">Pre</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">st'0</span> [<span class="id" title="var">Heq</span> <span class="id" title="var">HQ</span>] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">Heq</span>; <span class="id" title="tactic">subst</span>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Find&nbsp;contradictory&nbsp;assumption&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>2</sub></span> <span class="id" title="keyword">in</span> <span class="id" title="var">H<sub>5</sub></span>. <span class="id" title="tactic">apply</span> <span class="id" title="var">H<sub>5</sub></span> <span class="id" title="keyword">in</span> <span class="id" title="var">Pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">destruct</span> <span class="id" title="var">Pre</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">st'</span> [<span class="id" title="var">C</span> <span class="id" title="var">_</span>] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">C</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/>
</div>

<div class="doc">
State and prove your hoare rules, <span class="inlinecode"><span class="id" title="var">hoare_assert</span></span> and
    <span class="inlinecode"><span class="id" title="var">hoare_assume</span></span>, below. 
</div>
<div class="code">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
Here are the other proof rules (sanity check) 
</div>
<div class="code">
<span class="comment">(*&nbsp;NOTATION&nbsp;:&nbsp;IY&nbsp;--&nbsp;Do&nbsp;we&nbsp;want&nbsp;&lt;{&nbsp;}&gt;&nbsp;to&nbsp;be&nbsp;printing&nbsp;in&nbsp;here?&nbsp;*)</span><br/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_skip" class="idref" href="#HoareAssertAssume.hoare_skip"><span class="id" title="lemma">hoare_skip</span></a> : <span class="id" title="keyword">∀</span> <a id="P:333" class="idref" href="#P:333"><span class="id" title="binder">P</span></a>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:333"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'skip'"><span class="id" title="notation">skip</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:333"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">H</span> <span class="id" title="var">HP</span>. <span class="id" title="tactic">inversion</span> <span class="id" title="var">H</span>. <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">eexists</span>. <span class="id" title="tactic">split</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_if" class="idref" href="#HoareAssertAssume.hoare_if"><span class="id" title="lemma">hoare_if</span></a> : <span class="id" title="keyword">∀</span> <a id="P:334" class="idref" href="#P:334"><span class="id" title="binder">P</span></a> <a id="Q:335" class="idref" href="#Q:335"><span class="id" title="binder">Q</span></a> (<a id="b:336" class="idref" href="#b:336"><span class="id" title="binder">b</span></a>:<span class="id" title="inductive">bexp</span>) <a id="c<sub>1</sub>:337" class="idref" href="#c<sub>1</sub>:337"><span class="id" title="binder">c<sub>1</sub></span></a> <a id="c<sub>2</sub>:338" class="idref" href="#c<sub>2</sub>:338"><span class="id" title="binder">c<sub>2</sub></span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:334"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#b:336"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:337"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:335"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:334"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a> <a class="idref" href="Hoare.html#b:336"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:338"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:335"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:334"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">if</span></a> <a class="idref" href="Hoare.html#b:336"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">then</span></a> <a class="idref" href="Hoare.html#c<sub>1</sub>:337"><span class="id" title="variable">c<sub>1</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">else</span></a> <a class="idref" href="Hoare.html#c<sub>2</sub>:338"><span class="id" title="variable">c<sub>2</sub></span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'if'_x_'then'_x_'else'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#Q:335"><span class="id" title="variable">Q</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">Q</span> <span class="id" title="var">b</span> <span class="id" title="var">c<sub>1</sub></span> <span class="id" title="var">c<sub>2</sub></span> <span class="id" title="var">HTrue</span> <span class="id" title="var">HFalse</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">HE</span> <span class="id" title="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">HE</span>; <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;true&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> (<span class="id" title="var">HTrue</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">split</span>. <span class="id" title="tactic">assumption</span>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;false&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> (<span class="id" title="var">HFalse</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">split</span>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#bexp_eval_false"><span class="id" title="lemma">bexp_eval_false</span></a>. <span class="id" title="tactic">assumption</span>. <span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Theorem</span> <a id="HoareAssertAssume.hoare_while" class="idref" href="#HoareAssertAssume.hoare_while"><span class="id" title="lemma">hoare_while</span></a> : <span class="id" title="keyword">∀</span> <a id="P:339" class="idref" href="#P:339"><span class="id" title="binder">P</span></a> (<a id="b:340" class="idref" href="#b:340"><span class="id" title="binder">b</span></a>:<span class="id" title="inductive">bexp</span>) <a id="c:341" class="idref" href="#c:341"><span class="id" title="binder">c</span></a>,<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:339"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#b:340"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#c:341"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:339"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#::type_scope:x_'-&gt;'_x"><span class="id" title="notation">→</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="Hoare.html#P:339"><span class="id" title="variable">P</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <a class="idref" href="Hoare.html#b:340"><span class="id" title="variable">b</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <a class="idref" href="Hoare.html#c:341"><span class="id" title="variable">c</span></a> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a> <a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a> <a class="idref" href="Hoare.html#P:339"><span class="id" title="variable">P</span></a> <a class="idref" href="Hoare.html#cce4ad113420d0c25c6ce4891bbe5028"><span class="id" title="notation">∧</span></a> <a class="idref" href="Hoare.html#90b84b70bae2a0cf52991d884e146143"><span class="id" title="notation">¬</span></a><a class="idref" href="Hoare.html#b:340"><span class="id" title="variable">b</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">intros</span> <span class="id" title="var">P</span> <span class="id" title="var">b</span> <span class="id" title="var">c</span> <span class="id" title="var">Hhoare</span> <span class="id" title="var">st</span> <span class="id" title="var">st'</span> <span class="id" title="var">He</span> <span class="id" title="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" title="var">remember</span> <span class="id" title="notation">&lt;{</span><a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">while</span></a> <span class="id" title="var">b</span> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">do</span></a> <span class="id" title="var">c</span> <a class="idref" href="Hoare.html#HoareAssertAssume.:com::'while'_x_'do'_x_'end'"><span class="id" title="notation">end</span></a><span class="id" title="notation">}&gt;</span> <span class="id" title="keyword">as</span> <span class="id" title="var">wcom</span> <span class="id" title="var">eqn</span>:<span class="id" title="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;<span class="id" title="tactic">induction</span> <span class="id" title="var">He</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">try</span> (<span class="id" title="tactic">inversion</span> <span class="id" title="var">Heqwcom</span>); <span class="id" title="tactic">subst</span>; <span class="id" title="tactic">clear</span> <span class="id" title="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileFalse&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">eexists</span>. <span class="id" title="tactic">split</span>. <span class="id" title="tactic">reflexivity</span>. <span class="id" title="tactic">split</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>. <span class="id" title="tactic">apply</span> <a class="idref" href="Hoare.html#bexp_eval_false"><span class="id" title="lemma">bexp_eval_false</span></a>. <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileTrueNormal&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">clear</span> <span class="id" title="var">IHHe1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">IHHe2</span>. <span class="id" title="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">clear</span> <span class="id" title="var">IHHe2</span> <span class="id" title="var">He<sub>2</sub></span> <span class="id" title="var">r</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">Hhoare</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Hhoare</span> <span class="id" title="keyword">in</span> <span class="id" title="var">He<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">destruct</span> <span class="id" title="var">He<sub>1</sub></span> <span class="id" title="keyword">as</span> [<span class="id" title="var">st<sub>1</sub></span> [<span class="id" title="var">Heq</span> <span class="id" title="var">Hst1</span>] ].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">inversion</span> <span class="id" title="var">Heq</span>; <span class="id" title="tactic">subst</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">split</span>; <span class="id" title="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileTrueError&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="var">exfalso</span>. <span class="id" title="tactic">clear</span> <span class="id" title="var">IHHe</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">unfold</span> <a class="idref" href="Hoare.html#HoareAssertAssume.hoare_triple"><span class="id" title="definition">hoare_triple</span></a> <span class="id" title="keyword">in</span> <span class="id" title="var">Hhoare</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" title="tactic">apply</span> <span class="id" title="var">Hhoare</span> <span class="id" title="keyword">in</span> <span class="id" title="var">He</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">destruct</span> <span class="id" title="var">He</span> <span class="id" title="keyword">as</span> [<span class="id" title="var">st'</span> [<span class="id" title="var">C</span> <span class="id" title="var">_</span>] ]. <span class="id" title="tactic">inversion</span> <span class="id" title="var">C</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" title="tactic">split</span>; <span class="id" title="tactic">assumption</span>.<br/>
<span class="id" title="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">Example</span> <a id="HoareAssertAssume.assert_assume_example" class="idref" href="#HoareAssertAssume.assert_assume_example"><span class="id" title="definition">assert_assume_example</span></a>:<br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assume'_x"><span class="id" title="notation">assume</span></a> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 1<span class="id" title="notation">)</span><a class="idref" href="Hoare.html#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<span class="id" title="definition">X</span> <a class="idref" href="Hoare.html#60a9f580307c9b3c5e2be1b3b9a8ef<sub>14</sub>"><span class="id" title="notation">:=</span></a> <span class="id" title="definition">X</span> <span class="id" title="notation">+</span> 1<a class="idref" href="Hoare.html#20723b1e1e241a343867017aa438ad3d"><span class="id" title="notation">;</span></a><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#HoareAssertAssume.:com::'assert'_x"><span class="id" title="notation">assert</span></a> <span class="id" title="notation">(</span><span class="id" title="definition">X</span> <span class="id" title="notation">=</span> 2<span class="id" title="notation">)</span><br/>
&nbsp;&nbsp;<a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>{</span>{</span></a><a class="idref" href="http://coq.inria.fr/library//Coq.Init.Logic.html#True"><span class="id" title="inductive">True</span></a><a class="idref" href="Hoare.html#ab05c802c6c420830babdf44d877dfd1"><span class="id" title="notation"><span style='letter-spacing:-.4em;'>}</span>}</span></a>.<br/>
<span class="id" title="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" title="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" title="keyword">End</span> <a class="idref" href="Hoare.html#HoareAssertAssume"><span class="id" title="module">HoareAssertAssume</span></a>.<br/>
<font size=-2>&#9744;</font>
</div>

<div class="code">

<span class="comment">(*&nbsp;2021-08-11&nbsp;15:11&nbsp;*)</span><br/>
</div>
</div>

<div id="footer">
<hr/><a href="coqindex.html">Index</a><hr/>This page has been generated by <a href="http://coq.inria.fr/">coqdoc</a>
</div>

</div>

</body>
</html>